Re: [RFC/PATCH bpf-next] bpf: Fix d_path test after last fs update

[Jiri Olsa <olsajiri@gmail.com>]

On Wed, Aug 30, 2023 at 01:29:18PM -0700, Alexei Starovoitov wrote:
> On Wed, Aug 30, 2023 at 12:04 PM Jiri Olsa <olsajiri@gmail.com> wrote:
> >
> > On Wed, Aug 30, 2023 at 02:35:49PM -0400, Song Liu wrote:
> > > On Wed, Aug 30, 2023 at 9:27 AM Jiri Olsa <olsajiri@gmail.com> wrote:
> > > >
> > > > On Wed, Aug 30, 2023 at 11:35:02AM +0200, Jiri Olsa wrote:
> > > > > Recent commit [1] broken d_path test, because now filp_close is not
> > > > > called directly from sys_close, but eventually later when the file
> > > > > is finally released.
> > > > >
> > > > > I can't see any other solution than to hook filp_flush function and
> > > > > that also means we need to add it to btf_allowlist_d_path list, so
> > > > > it can use the d_path helper.
> > > > >
> > > > > But it's probably not very stable because filp_flush is static so it
> > > > > could be potentially inlined.
> > > >
> > > > looks like llvm makes it inlined (from CI)
> > > >
> > > >   Error: #68/1 d_path/basic
> > > >   libbpf: prog 'prog_close': failed to find kernel BTF type ID of 'filp_flush': -3
> > > >
> > > > jirka
> > >
> > > I played with it for a bit, but haven't got a good solution. Maybe we should
> > > just remove the test for close()?
> >
> > I was thinking the same.. also we have some example with filp_close in bpftrace
> > docs, I think we'll need to add some note with explanation in there
> 
> Maybe use __x64_sys_close in the test and recommend bpftrace scripts
> to do the same?

we need struct file pointer as an argument, __x64_sys_close has pt_regs pointer

jirka