bpftrace: Join broken by LLVM 14

Posted 2022-11-30 rtoax

Join broken by LLVM 14 · Issue #2222 · iovisor/bpftrace · GitHub

execsnoop.bt fails verifier check (R1 !read_ok) · Issue #2249 · iovisor/bpftrace · GitHub
https://github.com/iovisor/bpftrace/issues/2266
 

===========================

# join() 导致的问题

https://github.com/iovisor/bpftrace/issues/2222

R0_w=map_value(id=0,off=0,ks=4,vs=16400,imm=0) R1_w=inv30005 R6=ctx(id=0,off=0,imm=0) R7_w=map_value(id=0,off=0,ks=4,vs=16400,imm=0) R8_w=inv(id=0) R10=fp0 fp-8=mmmm???? fp-16=mmmmmmmm fp-24=mmmmmmmm fp-32=mmmmmmmm fp-40=mmmmmmmm
44: (bf) r1 = r10
45: (07) r1 += -40
46: (b7) r2 = 8
47: (bf) r3 = r8
48: (85) call bpf_probe_read_user#112
last_idx 48 first_idx 29
regs=4 stack=0 before 47: (bf) r3 = r8
regs=4 stack=0 before 46: (b7) r2 = 8
49: (79) r3 = *(u64 *)(r10 -40)
50: (b7) r2 = 1024
51: (85) call bpf_probe_read_user_str#114
R1 !read_ok
processed 48 insns (limit 1000000) max_states_per_insn 0 total_states 4 peak_states 4 mark_read 2


regs=40 stack=0 before 42: (b7) r6 = 0
45: (bf) r1 = r10
46: (07) r1 += -40
47: (b7) r2 = 8
48: (bf) r3 = r8
49: (85) call bpf_probe_read_user#112
last_idx 49 first_idx 29
regs=4 stack=0 before 48: (bf) r3 = r8
regs=4 stack=0 before 47: (b7) r2 = 8
50: (73) *(u8 *)(r1 +0) = r6
R1 !read_ok
processed 47 insns (limit 1000000) max_states_per_insn 0 total_states 4 peak_states 4 mark_read 2

ERROR: Error loading program: tracepoint:syscalls:sys_enter_execve

45: (bf) r1 = r10
46: (07) r1 += -40
47: (b7) r2 = 8
48: (bf) r3 = r8
49: (85) call bpf_probe_read_user#112
last_idx 49 first_idx 29
regs=4 stack=0 before 48: (bf) r3 = r8
regs=4 stack=0 before 47: (b7) r2 = 8
50: (79) r3 = *(u64 *)(r10 -40)
51: (b7) r2 = 1024
52: (85) call bpf_probe_read_user_str#114
R1 !read_ok
processed 49 insns (limit 1000000) max_states_per_insn 0 total_states 4 peak_states 4 mark_read 2