Re: [PATCH bpf-next] bpf:syscall: Log error code on trampoline unlink failure

[Leon Hwang <leon.hwang@linux.dev>]

On 16/7/26 13:55, xu.xin16@zte.com.cn wrote:
>> In subject, 'bpf:' is enough, 'syscall:' can be dropped.
> 
> Ok, thanks.
> 
>>
>> On 16/7/26 11:34, xu.xin16@zte.com.cn wrote:
>>> From: xu xin <xu.xin16@zte.com.cn>
>>>
>>> Replace silent WARN_ON_ONCE with WARN_ONCE that prints the actual error
>>> code from bpf_trampoline_unlink_prog(). This aids debugging of race
>>> conditions during link teardown, while keeping the warning rate limited
>>> to avoid log flooding.
>>
>>
>> Have you tried to trace bpf_trampoline_unlink_prog() with fexit?
>>
>> bpftrace -lv 'fexit:bpf_trampoline_unlink_prog'
>> kretfunc:vmlinux:bpf_trampoline_unlink_prog
>>     struct bpf_tramp_node * node
>>     struct bpf_trampoline * tr
>>     struct bpf_prog * tgt_prog
>>     int retval
>>
>> Since bpf_trampoline_unlink_prog() can be traced with fexit, it seems
>> unnecessary for this change?
> 
> Well, the crash may happen when the kernel is booting, or too hard to reproduce,
> in which case, bpftrace does not work.


Do you enable kernel.panic_on_warn sysctl?

If it's not enabled, the kernel won't crash, I think.

Thanks,
Leon

> 
> So this change will be more helpful, I believe.
> 
> Thanks,
> xu xin
>