From b7ef92e94019e16798fdafb9401ede2054b33ade Mon Sep 17 00:00:00 2001 From: Jiping Yin Date: Fri, 17 Jan 2025 16:39:55 +0800 Subject: [PATCH] fix: agent - eBPF Mitigating Memory Profile Load Failures (#8961) In the 4.14 kernel, a memory profile loading failure can prevent the entire eBPF program from functioning properly. This modification eliminates such an impact. --- agent/src/ebpf/user/load.c | 15 +++++++++++++-- agent/src/ebpf/user/proc.c | 9 +++++++-- 2 files changed, 20 insertions(+), 4 deletions(-) diff --git a/agent/src/ebpf/user/load.c b/agent/src/ebpf/user/load.c index 548c3d3863b..bae36fe500a 100644 --- a/agent/src/ebpf/user/load.c +++ b/agent/src/ebpf/user/load.c @@ -591,12 +591,16 @@ static int load_obj__progs(struct ebpf_object *obj) // Modify eBPF instructions based on BTF relocation information. obj_relocate_core(new_prog); + int stderr_fd = suspend_stderr(); + if (stderr_fd < 0) { + ebpf_warning("Failed to suspend stderr\n"); + } new_prog->prog_fd = bcc_prog_load(new_prog->type, new_prog->name, new_prog->insns, desc->size, obj->license, obj->kern_version, 0, NULL, 0 /*EBPF_LOG_LEVEL, log_buf, LOG_BUF_SZ */ ); - + resume_stderr(stderr_fd); if (new_prog->prog_fd < 0) { ebpf_warning ("bcc_prog_load() failed. name: %s, %s errno: %d\n", @@ -608,7 +612,14 @@ static int load_obj__progs(struct ebpf_object *obj) new_prog->insns_cnt, BPF_MAXINSNS); } - return ETR_INVAL; + if (memcmp(desc->name, "uprobe/", 7) && + memcmp(desc->name, "uretprobe/", 10)) { + return ETR_INVAL; + } else { + ebpf_warning("The reason for the eBPF uprobe program " + "loading failure is that the linux version " + "needs to be 3.10 or 4.17+.\n"); + } } ebpf_debug diff --git a/agent/src/ebpf/user/proc.c b/agent/src/ebpf/user/proc.c index 6f1776089f9..8667bf059b0 100644 --- a/agent/src/ebpf/user/proc.c +++ b/agent/src/ebpf/user/proc.c @@ -1011,8 +1011,13 @@ extern uint32_t k_version; // Lower version kernels do not support hooking so files in containers bool kernel_version_check(void) { - return ((k_version == KERNEL_VERSION(3, 10, 0)) - || (k_version >= KERNEL_VERSION(4, 17, 0))); + bool ret = ((k_version == KERNEL_VERSION(3, 10, 0)) + || (k_version >= KERNEL_VERSION(4, 17, 0))); + if (!ret) + ebpf_warning("UPROBE feature requires linux " + "version of 3.10 or 4.17+.\n"); + + return ret; } bool process_probing_check(int pid)