Re: [RFC/PATCH bpf-next] bpf: Fix d_path test after last fs update

[Jiri Olsa <olsajiri@gmail.com>]

On Wed, Aug 30, 2023 at 02:35:49PM -0400, Song Liu wrote:
> On Wed, Aug 30, 2023 at 9:27 AM Jiri Olsa <olsajiri@gmail.com> wrote:
> >
> > On Wed, Aug 30, 2023 at 11:35:02AM +0200, Jiri Olsa wrote:
> > > Recent commit [1] broken d_path test, because now filp_close is not
> > > called directly from sys_close, but eventually later when the file
> > > is finally released.
> > >
> > > I can't see any other solution than to hook filp_flush function and
> > > that also means we need to add it to btf_allowlist_d_path list, so
> > > it can use the d_path helper.
> > >
> > > But it's probably not very stable because filp_flush is static so it
> > > could be potentially inlined.
> >
> > looks like llvm makes it inlined (from CI)
> >
> >   Error: #68/1 d_path/basic
> >   libbpf: prog 'prog_close': failed to find kernel BTF type ID of 'filp_flush': -3
> >
> > jirka
> 
> I played with it for a bit, but haven't got a good solution. Maybe we should
> just remove the test for close()?

I was thinking the same.. also we have some example with filp_close in bpftrace
docs, I think we'll need to add some note with explanation in there 

jirka

> 
> Thanks,
> Song
> >
> > >
> > > Also if we'd keep the current filp_close hook and find a way how to 'wait'
> > > for it to be called so user space can go with checks, then it looks
> > > like d_path might not work properly when the task is no longer around.
> 
> [...]