On Wed, Aug 30, 2023 at 02:35:49PM -0400, Song Liu wrote: > On Wed, Aug 30, 2023 at 9:27 AM Jiri Olsa <olsajiri@xxxxxxxxx> wrote: > > > > On Wed, Aug 30, 2023 at 11:35:02AM +0200, Jiri Olsa wrote: > > > Recent commit [1] broken d_path test, because now filp_close is not > > > called directly from sys_close, but eventually later when the file > > > is finally released. > > > > > > I can't see any other solution than to hook filp_flush function and > > > that also means we need to add it to btf_allowlist_d_path list, so > > > it can use the d_path helper. > > > > > > But it's probably not very stable because filp_flush is static so it > > > could be potentially inlined. > > > > looks like llvm makes it inlined (from CI) > > > > Error: #68/1 d_path/basic > > libbpf: prog 'prog_close': failed to find kernel BTF type ID of 'filp_flush': -3 > > > > jirka > > I played with it for a bit, but haven't got a good solution. Maybe we should > just remove the test for close()? I was thinking the same.. also we have some example with filp_close in bpftrace docs, I think we'll need to add some note with explanation in there jirka > > Thanks, > Song > > > > > > > > Also if we'd keep the current filp_close hook and find a way how to 'wait' > > > for it to be called so user space can go with checks, then it looks > > > like d_path might not work properly when the task is no longer around. > > [...]
