* [PATCH] Fix proc:::exec args[0]
@ 2025-10-02 5:05 eugene.loh
2025-10-02 14:34 ` Kris Van Hees
0 siblings, 1 reply; 2+ messages in thread
From: eugene.loh @ 2025-10-02 5:05 UTC (permalink / raw)
To: dtrace, dtrace-devel
From: Eugene Loh <eugene.loh@oracle.com>
Reported-by: Kris Van Hees <kris.van.hees@oracle.com>
Signed-off-by: Eugene Loh <eugene.loh@oracle.com>
---
libdtrace/dt_prov_proc.c | 12 ++++++
test/unittest/proc/tst.exec-execve.r | 4 ++
test/unittest/proc/tst.exec-execve.sh | 52 ++++++++++++++++++++++++
test/unittest/proc/tst.exec-execveat.r | 4 ++
test/unittest/proc/tst.exec-execveat.sh | 54 +++++++++++++++++++++++++
5 files changed, 126 insertions(+)
create mode 100644 test/unittest/proc/tst.exec-execve.r
create mode 100755 test/unittest/proc/tst.exec-execve.sh
create mode 100644 test/unittest/proc/tst.exec-execveat.r
create mode 100755 test/unittest/proc/tst.exec-execveat.sh
diff --git a/libdtrace/dt_prov_proc.c b/libdtrace/dt_prov_proc.c
index 05ad66346..f7e46a5af 100644
--- a/libdtrace/dt_prov_proc.c
+++ b/libdtrace/dt_prov_proc.c
@@ -118,6 +118,18 @@ static int trampoline(dt_pcb_t *pcb, uint_t exitlbl)
emit(dlp, BPF_LOAD(BPF_DW, BPF_REG_0, BPF_REG_7, DMST_ARG(1)));
emit(dlp, BPF_BRANCH_IMM(BPF_JEQ, BPF_REG_0, 0, exitlbl));
emit(dlp, BPF_STORE(BPF_DW, BPF_REG_7, DMST_ARG(0), BPF_REG_0));
+ } else if (strcmp(prp->desc->prb, "exec") == 0) {
+ dt_probe_t *uprp = pcb->pcb_parent_probe;
+
+ /*
+ * If the underlying probe is syscall:vmlinux:execve:entry,
+ * then the arg0 is already right. If it is execveat, we have
+ * to copy arg1 to arg0.
+ */
+ if (strcmp(uprp->desc->fun, "execveat") == 0) {
+ emit(dlp, BPF_LOAD(BPF_DW, BPF_REG_0, BPF_REG_7, DMST_ARG(1)));
+ emit(dlp, BPF_STORE(BPF_DW, BPF_REG_7, DMST_ARG(0), BPF_REG_0));
+ }
} else if (strcmp(prp->desc->prb, "exit") == 0) {
ctf_file_t *cfp = dtp->dt_shared_ctf;
ctf_id_t type;
diff --git a/test/unittest/proc/tst.exec-execve.r b/test/unittest/proc/tst.exec-execve.r
new file mode 100644
index 000000000..09791d5b0
--- /dev/null
+++ b/test/unittest/proc/tst.exec-execve.r
@@ -0,0 +1,4 @@
+execve bogus_direc/bogus_exec
+proc:::exec bogus_direc/bogus_exec
+exec
+
diff --git a/test/unittest/proc/tst.exec-execve.sh b/test/unittest/proc/tst.exec-execve.sh
new file mode 100755
index 000000000..d3f84e0d2
--- /dev/null
+++ b/test/unittest/proc/tst.exec-execve.sh
@@ -0,0 +1,52 @@
+#!/bin/bash
+#
+# Oracle Linux DTrace.
+# Copyright (c) 2025, Oracle and/or its affiliates. All rights reserved.
+# Licensed under the Universal Permissive License v 1.0 as shown at
+# http://oss.oracle.com/licenses/upl.
+#
+# This script tests that the proc:::exec probe fires for execve() and
+# produces the correct probe arg.
+
+dtrace=$1
+
+DIRNAME="$tmpdir/exec-execve.$$.$RANDOM"
+mkdir -p $DIRNAME
+cd $DIRNAME
+
+cat << EOF > parent.c
+#include <stdio.h>
+#include <unistd.h>
+
+int main(int c, char **v) {
+ char *argv[] = { "bogus_exec", NULL };
+ char *envp[] = { NULL };
+ int rc;
+
+ printf("exec\n");
+ rc = execve("bogus_direc/bogus_exec", argv, envp);
+
+ return 0;
+}
+EOF
+
+${CC} -o parent.x parent.c
+
+$dtrace $dt_flags -qn '
+BEGIN { dtpid = pid; }
+proc:::exec
+/ppid == dtpid && execname == "parent.x"/
+{
+ printf("proc:::exec %s\n", args[0]);
+}
+syscall::execve:entry
+/ppid == dtpid && execname == "parent.x"/
+{
+ printf("execve %s\n", stringof(arg0));
+}' -c ./parent.x
+if [ $? -ne 0 ]; then
+ echo ERROR
+ exit 1
+fi
+
+exit 0
diff --git a/test/unittest/proc/tst.exec-execveat.r b/test/unittest/proc/tst.exec-execveat.r
new file mode 100644
index 000000000..696300e0e
--- /dev/null
+++ b/test/unittest/proc/tst.exec-execveat.r
@@ -0,0 +1,4 @@
+execveat bogus_direc/bogus_exec
+proc:::exec bogus_direc/bogus_exec
+exec
+
diff --git a/test/unittest/proc/tst.exec-execveat.sh b/test/unittest/proc/tst.exec-execveat.sh
new file mode 100755
index 000000000..db68a5043
--- /dev/null
+++ b/test/unittest/proc/tst.exec-execveat.sh
@@ -0,0 +1,54 @@
+#!/bin/bash
+#
+# Oracle Linux DTrace.
+# Copyright (c) 2025, Oracle and/or its affiliates. All rights reserved.
+# Licensed under the Universal Permissive License v 1.0 as shown at
+# http://oss.oracle.com/licenses/upl.
+#
+# This script tests that the proc:::exec probe fires for execveat() and
+# produces the correct probe arg.
+
+dtrace=$1
+
+DIRNAME="$tmpdir/exec-execveat.$$.$RANDOM"
+mkdir -p $DIRNAME
+cd $DIRNAME
+
+cat << EOF > parent.c
+#include <stdio.h>
+#include <linux/fcntl.h> /* Definition of AT_* constants */
+#define __USE_GNU /* so unistd.h will find execveat */
+#include <unistd.h>
+
+int main(int c, char **v) {
+ char *argv[] = { "bogus_exec", NULL };
+ char *envp[] = { NULL };
+ int rc;
+
+ printf("exec\n");
+ rc = execveat(AT_FDCWD, "bogus_direc/bogus_exec", argv, envp, 0);
+
+ return 0;
+}
+EOF
+
+${CC} -o parent.x parent.c
+
+$dtrace $dt_flags -qn '
+BEGIN { dtpid = pid; }
+proc:::exec
+/ppid == dtpid && execname == "parent.x"/
+{
+ printf("proc:::exec %s\n", args[0]);
+}
+syscall::execveat:entry
+/ppid == dtpid && execname == "parent.x"/
+{
+ printf("execveat %s\n", stringof(arg1));
+}' -c ./parent.x
+if [ $? -ne 0 ]; then
+ echo ERROR
+ exit 1
+fi
+
+exit 0
--
2.47.3
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] Fix proc:::exec args[0]
2025-10-02 5:05 [PATCH] Fix proc:::exec args[0] eugene.loh
@ 2025-10-02 14:34 ` Kris Van Hees
0 siblings, 0 replies; 2+ messages in thread
From: Kris Van Hees @ 2025-10-02 14:34 UTC (permalink / raw)
To: eugene.loh; +Cc: dtrace, dtrace-devel
On Thu, Oct 02, 2025 at 01:05:58AM -0400, eugene.loh@oracle.com wrote:
> From: Eugene Loh <eugene.loh@oracle.com>
>
> Reported-by: Kris Van Hees <kris.van.hees@oracle.com>
> Signed-off-by: Eugene Loh <eugene.loh@oracle.com>
Reviewed-by: Kris Van Hees <kris.van.hees@oracle.com>
> ---
> libdtrace/dt_prov_proc.c | 12 ++++++
> test/unittest/proc/tst.exec-execve.r | 4 ++
> test/unittest/proc/tst.exec-execve.sh | 52 ++++++++++++++++++++++++
> test/unittest/proc/tst.exec-execveat.r | 4 ++
> test/unittest/proc/tst.exec-execveat.sh | 54 +++++++++++++++++++++++++
> 5 files changed, 126 insertions(+)
> create mode 100644 test/unittest/proc/tst.exec-execve.r
> create mode 100755 test/unittest/proc/tst.exec-execve.sh
> create mode 100644 test/unittest/proc/tst.exec-execveat.r
> create mode 100755 test/unittest/proc/tst.exec-execveat.sh
>
> diff --git a/libdtrace/dt_prov_proc.c b/libdtrace/dt_prov_proc.c
> index 05ad66346..f7e46a5af 100644
> --- a/libdtrace/dt_prov_proc.c
> +++ b/libdtrace/dt_prov_proc.c
> @@ -118,6 +118,18 @@ static int trampoline(dt_pcb_t *pcb, uint_t exitlbl)
> emit(dlp, BPF_LOAD(BPF_DW, BPF_REG_0, BPF_REG_7, DMST_ARG(1)));
> emit(dlp, BPF_BRANCH_IMM(BPF_JEQ, BPF_REG_0, 0, exitlbl));
> emit(dlp, BPF_STORE(BPF_DW, BPF_REG_7, DMST_ARG(0), BPF_REG_0));
> + } else if (strcmp(prp->desc->prb, "exec") == 0) {
> + dt_probe_t *uprp = pcb->pcb_parent_probe;
> +
> + /*
> + * If the underlying probe is syscall:vmlinux:execve:entry,
> + * then the arg0 is already right. If it is execveat, we have
> + * to copy arg1 to arg0.
> + */
> + if (strcmp(uprp->desc->fun, "execveat") == 0) {
> + emit(dlp, BPF_LOAD(BPF_DW, BPF_REG_0, BPF_REG_7, DMST_ARG(1)));
> + emit(dlp, BPF_STORE(BPF_DW, BPF_REG_7, DMST_ARG(0), BPF_REG_0));
> + }
> } else if (strcmp(prp->desc->prb, "exit") == 0) {
> ctf_file_t *cfp = dtp->dt_shared_ctf;
> ctf_id_t type;
> diff --git a/test/unittest/proc/tst.exec-execve.r b/test/unittest/proc/tst.exec-execve.r
> new file mode 100644
> index 000000000..09791d5b0
> --- /dev/null
> +++ b/test/unittest/proc/tst.exec-execve.r
> @@ -0,0 +1,4 @@
> +execve bogus_direc/bogus_exec
> +proc:::exec bogus_direc/bogus_exec
> +exec
> +
> diff --git a/test/unittest/proc/tst.exec-execve.sh b/test/unittest/proc/tst.exec-execve.sh
> new file mode 100755
> index 000000000..d3f84e0d2
> --- /dev/null
> +++ b/test/unittest/proc/tst.exec-execve.sh
> @@ -0,0 +1,52 @@
> +#!/bin/bash
> +#
> +# Oracle Linux DTrace.
> +# Copyright (c) 2025, Oracle and/or its affiliates. All rights reserved.
> +# Licensed under the Universal Permissive License v 1.0 as shown at
> +# http://oss.oracle.com/licenses/upl.
> +#
> +# This script tests that the proc:::exec probe fires for execve() and
> +# produces the correct probe arg.
> +
> +dtrace=$1
> +
> +DIRNAME="$tmpdir/exec-execve.$$.$RANDOM"
> +mkdir -p $DIRNAME
> +cd $DIRNAME
> +
> +cat << EOF > parent.c
> +#include <stdio.h>
> +#include <unistd.h>
> +
> +int main(int c, char **v) {
> + char *argv[] = { "bogus_exec", NULL };
> + char *envp[] = { NULL };
> + int rc;
> +
> + printf("exec\n");
> + rc = execve("bogus_direc/bogus_exec", argv, envp);
> +
> + return 0;
> +}
> +EOF
> +
> +${CC} -o parent.x parent.c
> +
> +$dtrace $dt_flags -qn '
> +BEGIN { dtpid = pid; }
> +proc:::exec
> +/ppid == dtpid && execname == "parent.x"/
> +{
> + printf("proc:::exec %s\n", args[0]);
> +}
> +syscall::execve:entry
> +/ppid == dtpid && execname == "parent.x"/
> +{
> + printf("execve %s\n", stringof(arg0));
> +}' -c ./parent.x
> +if [ $? -ne 0 ]; then
> + echo ERROR
> + exit 1
> +fi
> +
> +exit 0
> diff --git a/test/unittest/proc/tst.exec-execveat.r b/test/unittest/proc/tst.exec-execveat.r
> new file mode 100644
> index 000000000..696300e0e
> --- /dev/null
> +++ b/test/unittest/proc/tst.exec-execveat.r
> @@ -0,0 +1,4 @@
> +execveat bogus_direc/bogus_exec
> +proc:::exec bogus_direc/bogus_exec
> +exec
> +
> diff --git a/test/unittest/proc/tst.exec-execveat.sh b/test/unittest/proc/tst.exec-execveat.sh
> new file mode 100755
> index 000000000..db68a5043
> --- /dev/null
> +++ b/test/unittest/proc/tst.exec-execveat.sh
> @@ -0,0 +1,54 @@
> +#!/bin/bash
> +#
> +# Oracle Linux DTrace.
> +# Copyright (c) 2025, Oracle and/or its affiliates. All rights reserved.
> +# Licensed under the Universal Permissive License v 1.0 as shown at
> +# http://oss.oracle.com/licenses/upl.
> +#
> +# This script tests that the proc:::exec probe fires for execveat() and
> +# produces the correct probe arg.
> +
> +dtrace=$1
> +
> +DIRNAME="$tmpdir/exec-execveat.$$.$RANDOM"
> +mkdir -p $DIRNAME
> +cd $DIRNAME
> +
> +cat << EOF > parent.c
> +#include <stdio.h>
> +#include <linux/fcntl.h> /* Definition of AT_* constants */
> +#define __USE_GNU /* so unistd.h will find execveat */
> +#include <unistd.h>
> +
> +int main(int c, char **v) {
> + char *argv[] = { "bogus_exec", NULL };
> + char *envp[] = { NULL };
> + int rc;
> +
> + printf("exec\n");
> + rc = execveat(AT_FDCWD, "bogus_direc/bogus_exec", argv, envp, 0);
> +
> + return 0;
> +}
> +EOF
> +
> +${CC} -o parent.x parent.c
> +
> +$dtrace $dt_flags -qn '
> +BEGIN { dtpid = pid; }
> +proc:::exec
> +/ppid == dtpid && execname == "parent.x"/
> +{
> + printf("proc:::exec %s\n", args[0]);
> +}
> +syscall::execveat:entry
> +/ppid == dtpid && execname == "parent.x"/
> +{
> + printf("execveat %s\n", stringof(arg1));
> +}' -c ./parent.x
> +if [ $? -ne 0 ]; then
> + echo ERROR
> + exit 1
> +fi
> +
> +exit 0
> --
> 2.47.3
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-10-02 14:34 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-10-02 5:05 [PATCH] Fix proc:::exec args[0] eugene.loh
2025-10-02 14:34 ` Kris Van Hees
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox