Skip to content

selftests: ringbuffers: give time to ringbuffer consumer #86

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 30, 2021

Conversation

geyslan
Copy link
Member

@geyslan geyslan commented Oct 26, 2021

Depending on the hardware used in this test, the result was either error or success.

I put some prints and found that in the test with faster hardware, the loader, when trying to consume the rinbuffer, was already in an overflowed state.

Debugging with the infamous print:

char LICENSE[] SEC("license") = "Dual BSD/GPL";

long ringbuffer_flags = 0;

SEC("kprobe/sys_mmap")
int kprobe__sys_mmap(struct pt_regs *ctx)
{
    int *process;

    bpf_printk("before");

    // Reserve space on the ringbuffer for the sample
    process = bpf_ringbuf_reserve(&events, sizeof(int), 0);
    if (!process) {
        return 0;
    }

    bpf_printk("between");

    *process = 2021;

    bpf_ringbuf_submit(process, 0);

    bpf_printk("after");

    return 0;
}

The output of trace_pipe:

...
     main-static-11511   [007] d..3  2237.755619: bpf_trace_printk: before
     main-static-11511   [007] d..3  2237.755619: bpf_trace_printk: before
     main-static-11511   [007] d..3  2237.755620: bpf_trace_printk: before
     main-static-11511   [007] d..3  2237.755620: bpf_trace_printk: before
     main-static-11511   [007] d..3  2237.755620: bpf_trace_printk: before
     main-static-11511   [007] d..3  2237.755621: bpf_trace_printk: before
CPU:7 [LOST 1020 EVENTS]
     main-static-11511   [007] d..3  2237.756004: bpf_trace_printk: before
     main-static-11511   [007] d..3  2237.756005: bpf_trace_printk: before
     main-static-11511   [007] d..3  2237.756005: bpf_trace_printk: before
     main-static-11511   [007] d..3  2237.756005: bpf_trace_printk: before
     main-static-11511   [007] d..3  2237.756006: bpf_trace_printk: before
     main-static-11511   [007] d..3  2237.756006: bpf_trace_printk: before
...

This way, I added a sleep between the syscall mmap calls, allowing the loader to breathe and be able to consume the ringbuffer before it fills up.

Fixes #85

Depending on the hardware used in this test, the result was either
error or success.

I put some prints and found that in the test with faster hardware,
the loader, when trying to consume the rinbuffer, was already
in an overflowed state.

Debugging with the infamous print:

char LICENSE[] SEC("license") = "Dual BSD/GPL";

long ringbuffer_flags = 0;

SEC("kprobe/sys_mmap")
int kprobe__sys_mmap(struct pt_regs *ctx)
{
    int *process;

    bpf_printk("before");

    // Reserve space on the ringbuffer for the sample
    process = bpf_ringbuf_reserve(&events, sizeof(int), 0);
    if (!process) {
        return 0;
    }

    bpf_printk("between");

    *process = 2021;

    bpf_ringbuf_submit(process, 0);

    bpf_printk("after");

    return 0;
}

The output of trace_pipe:

...
     main-static-11511   [007] d..3  2237.755619: bpf_trace_printk: before
     main-static-11511   [007] d..3  2237.755619: bpf_trace_printk: before
     main-static-11511   [007] d..3  2237.755620: bpf_trace_printk: before
     main-static-11511   [007] d..3  2237.755620: bpf_trace_printk: before
     main-static-11511   [007] d..3  2237.755620: bpf_trace_printk: before
     main-static-11511   [007] d..3  2237.755621: bpf_trace_printk: before
CPU:7 [LOST 1020 EVENTS]
     main-static-11511   [007] d..3  2237.756004: bpf_trace_printk: before
     main-static-11511   [007] d..3  2237.756005: bpf_trace_printk: before
     main-static-11511   [007] d..3  2237.756005: bpf_trace_printk: before
     main-static-11511   [007] d..3  2237.756005: bpf_trace_printk: before
     main-static-11511   [007] d..3  2237.756006: bpf_trace_printk: before
     main-static-11511   [007] d..3  2237.756006: bpf_trace_printk: before
...

This way, I added a sleep between the syscall mmap calls, allowing the
loader to breathe and be able to consume the ringbuffer before it fills up.

Fixes aquasecurity#85
Copy link
Contributor

@rafaeldtinoco rafaeldtinoco left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the fix Geyslan!

@rafaeldtinoco rafaeldtinoco merged commit 0b4cdef into aquasecurity:main Oct 30, 2021
@geyslan geyslan deleted the 85-fix-timeout branch March 31, 2023 23:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

selftests: ringbuffers: failing with timeout
2 participants