[PATCH v3] dtprobed: use /proc/$pid/map_files, not the filename of the mapping

[PATCH v3] dtprobed: use /proc/$pid/map_files, not the filename of the mapping

[Nick Alcock]

From: Eugene Loh <eugene.loh@oracle.com>

Instead of using prf->prf_mapname (which resolves to the mapped file's
target), use Pmap_mapfile_name() to get the actual
/proc/$pid/map_files/* path.  These magic symlinks can be opened even
when their corresponding files are deleted or in an inaccessible
filesystem namespace, ensuring we can read the mapping contents
reliably.  DTrace already does this to read mappings during USDT probe
lookup.

(We still use prf->prf_mapname to determine the module name used in the
dof helper, and thus ultimately in the probespec, because that should be
an actual user-readable module name, not some random address-space-like
filename: it doesn't matter that that name might not exist on the
filesystem.  Thanks to Eugene Loh for spotting this and Kris van Hees
for fixing it.)

Fixes issues with probes in paths like /home when dtprobed
is sandboxed by systemd.

Tested on both systemd and non-systemd (non-jailed) systems, with USDT
programs running out of /tmp, /usr/local and /home.

Signed-off-by: Nick Alcock <nick.alcock@oracle.com>
---
 dtprobed/dtprobed.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/dtprobed/dtprobed.c b/dtprobed/dtprobed.c
index a808586559d96..34349deb028be 100644
--- a/dtprobed/dtprobed.c
+++ b/dtprobed/dtprobed.c
@@ -487,16 +487,17 @@ handle_usdt_notes(pid_t pid, uintptr_t addr)
 		fuse_log(FUSE_LOG_ERR, "%i: dtprobed: cannot look up mapping (process dead?)\n",
 			 pid);
 		goto out;
-	} else if ((fn = prf->prf_mapname) == NULL) {
+	} else if (prf->prf_mapname == NULL ||
+		   (fn = Pmap_mapfile_name(P, mapp)) == NULL) {
 		fuse_log(FUSE_LOG_ERR, "%i: dtprobed: cannot look up mapname (process dead?)\n",
 			 pid);
 		goto out;
 	}
-	mod = strrchr(fn, '/');
+	mod = strrchr(prf->prf_mapname, '/');
 	if (mod)
 		mod++;
 	else
-		mod = fn;
+		mod = prf->prf_mapname;
 	snprintf(dh.dofhp_mod, sizeof(dh.dofhp_mod), "%s", mod);
 
 	dh.dofhp_addr = mapp->pr_vaddr;

base-commit: 9abccde65bd924a5b63258eebb5210952709768d
prerequisite-patch-id: d178f9e04afa5cca97d93ef7659a72dff6d364b6
-- 
2.53.0.286.g870d7528e3

Re: [PATCH v3] dtprobed: use /proc/$pid/map_files, not the filename of the mapping

[Kris Van Hees]

On Thu, Feb 12, 2026 at 07:17:29PM +0000, Nick Alcock wrote:
> From: Eugene Loh <eugene.loh@oracle.com>
> 
> Instead of using prf->prf_mapname (which resolves to the mapped file's
> target), use Pmap_mapfile_name() to get the actual
> /proc/$pid/map_files/* path.  These magic symlinks can be opened even
> when their corresponding files are deleted or in an inaccessible
> filesystem namespace, ensuring we can read the mapping contents
> reliably.  DTrace already does this to read mappings during USDT probe
> lookup.
> 
> (We still use prf->prf_mapname to determine the module name used in the
> dof helper, and thus ultimately in the probespec, because that should be
> an actual user-readable module name, not some random address-space-like
> filename: it doesn't matter that that name might not exist on the
> filesystem.  Thanks to Eugene Loh for spotting this and Kris van Hees
> for fixing it.)
> 
> Fixes issues with probes in paths like /home when dtprobed
> is sandboxed by systemd.
> 
> Tested on both systemd and non-systemd (non-jailed) systems, with USDT
> programs running out of /tmp, /usr/local and /home.
> 
> Signed-off-by: Nick Alcock <nick.alcock@oracle.com>

Reviewed-by: Kris Van Hees <kris.van.hees@oracle.com>

> ---
>  dtprobed/dtprobed.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/dtprobed/dtprobed.c b/dtprobed/dtprobed.c
> index a808586559d96..34349deb028be 100644
> --- a/dtprobed/dtprobed.c
> +++ b/dtprobed/dtprobed.c
> @@ -487,16 +487,17 @@ handle_usdt_notes(pid_t pid, uintptr_t addr)
>  		fuse_log(FUSE_LOG_ERR, "%i: dtprobed: cannot look up mapping (process dead?)\n",
>  			 pid);
>  		goto out;
> -	} else if ((fn = prf->prf_mapname) == NULL) {
> +	} else if (prf->prf_mapname == NULL ||
> +		   (fn = Pmap_mapfile_name(P, mapp)) == NULL) {
>  		fuse_log(FUSE_LOG_ERR, "%i: dtprobed: cannot look up mapname (process dead?)\n",
>  			 pid);
>  		goto out;
>  	}
> -	mod = strrchr(fn, '/');
> +	mod = strrchr(prf->prf_mapname, '/');
>  	if (mod)
>  		mod++;
>  	else
> -		mod = fn;
> +		mod = prf->prf_mapname;
>  	snprintf(dh.dofhp_mod, sizeof(dh.dofhp_mod), "%s", mod);
>  
>  	dh.dofhp_addr = mapp->pr_vaddr;
> 
> base-commit: 9abccde65bd924a5b63258eebb5210952709768d
> prerequisite-patch-id: d178f9e04afa5cca97d93ef7659a72dff6d364b6
> -- 
> 2.53.0.286.g870d7528e3
>