On Thu, 29 Feb 2024 15:38:55 +0900 Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx> wrote: > Hmm, this seems arch_rethook_trampoline caused the issue. > > And curiously, it depends on the number of stored data. > > OK: > /sys/kernel/tracing # echo 'f vfs_read%return $arg1 $arg2 $arg3' >> dynamic_events > /sys/kernel/tracing # echo 1 > events/fprobes/enable > > NG: > /sys/kernel/tracing # echo 'f vfs_read%return $arg1 $arg2 $arg3 $arg4' >> dynamic_events > /sys/kernel/tracing # echo 1 > events/fprobes/enable > > I also confirmed that on 'vfs_write' caused the same result. 3 arguments(24 bytes) is OK, > but 4 arguments (32bytes) is NG. And this may be the fprobe bug. kretprobe events doesn't show this issue. OK: /sys/kernel/tracing # echo 'r vfs_read $arg*' >> kprobe_events /sys/kernel/tracing # echo 1 > events/kprobes/enable But this is strange because both uses same rethook... Thank you, -- Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>
