Re: [PATCH v3] dtprobed: use /proc/$pid/map_files, not the filename of the mapping

[Kris Van Hees <kris.van.hees@oracle.com>]

On Thu, Feb 12, 2026 at 07:17:29PM +0000, Nick Alcock wrote:
> From: Eugene Loh <eugene.loh@oracle.com>
> 
> Instead of using prf->prf_mapname (which resolves to the mapped file's
> target), use Pmap_mapfile_name() to get the actual
> /proc/$pid/map_files/* path.  These magic symlinks can be opened even
> when their corresponding files are deleted or in an inaccessible
> filesystem namespace, ensuring we can read the mapping contents
> reliably.  DTrace already does this to read mappings during USDT probe
> lookup.
> 
> (We still use prf->prf_mapname to determine the module name used in the
> dof helper, and thus ultimately in the probespec, because that should be
> an actual user-readable module name, not some random address-space-like
> filename: it doesn't matter that that name might not exist on the
> filesystem.  Thanks to Eugene Loh for spotting this and Kris van Hees
> for fixing it.)
> 
> Fixes issues with probes in paths like /home when dtprobed
> is sandboxed by systemd.
> 
> Tested on both systemd and non-systemd (non-jailed) systems, with USDT
> programs running out of /tmp, /usr/local and /home.
> 
> Signed-off-by: Nick Alcock <nick.alcock@oracle.com>

Reviewed-by: Kris Van Hees <kris.van.hees@oracle.com>

> ---
>  dtprobed/dtprobed.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/dtprobed/dtprobed.c b/dtprobed/dtprobed.c
> index a808586559d96..34349deb028be 100644
> --- a/dtprobed/dtprobed.c
> +++ b/dtprobed/dtprobed.c
> @@ -487,16 +487,17 @@ handle_usdt_notes(pid_t pid, uintptr_t addr)
>  		fuse_log(FUSE_LOG_ERR, "%i: dtprobed: cannot look up mapping (process dead?)\n",
>  			 pid);
>  		goto out;
> -	} else if ((fn = prf->prf_mapname) == NULL) {
> +	} else if (prf->prf_mapname == NULL ||
> +		   (fn = Pmap_mapfile_name(P, mapp)) == NULL) {
>  		fuse_log(FUSE_LOG_ERR, "%i: dtprobed: cannot look up mapname (process dead?)\n",
>  			 pid);
>  		goto out;
>  	}
> -	mod = strrchr(fn, '/');
> +	mod = strrchr(prf->prf_mapname, '/');
>  	if (mod)
>  		mod++;
>  	else
> -		mod = fn;
> +		mod = prf->prf_mapname;
>  	snprintf(dh.dofhp_mod, sizeof(dh.dofhp_mod), "%s", mod);
>  
>  	dh.dofhp_addr = mapp->pr_vaddr;
> 
> base-commit: 9abccde65bd924a5b63258eebb5210952709768d
> prerequisite-patch-id: d178f9e04afa5cca97d93ef7659a72dff6d364b6
> -- 
> 2.53.0.286.g870d7528e3
>