Skip to content

libbpf-tools/filelife: Fix wrong full-path#5347

Merged
yonghong-song merged 1 commit intoiovisor:masterfrom
Rtoax:patch-102-libbpf-filelife-fix-full-path
Jul 13, 2025
Merged

libbpf-tools/filelife: Fix wrong full-path#5347
yonghong-song merged 1 commit intoiovisor:masterfrom
Rtoax:patch-102-libbpf-filelife-fix-full-path

Conversation

@Rtoax
Copy link
Contributor

@Rtoax Rtoax commented Jul 1, 2025

The process that creates the file and the process that deletes the file may be two completely different processes, and their cwds are different. We get the file name from the file dentry and concatenate the cwd to create the full-path. If we use the dentry name of the deleted file + the cwd-dentry of the process that created the file, we will get an incorrect full-path. For example:

$ realpath .
/home/sda/git-repos/iovisor/bcc/libbpf-tools

(1) correct full-path

$ touch a.out               cwd_dentry = /home/sda/git-repos/iovisor/bcc/libbpf-tools
$ cd ..
$ rm libbpf-tools/a.out     dentry = a.out

(2) wrong full-path

$ touch libbpf-tools/a.out  cwd_dentry = /home/sda/git-repos/iovisor/bcc/
$ cd libbpf-tools/
$ rm a.out                  dentry = a.out

$ sudo ./filelife -F
Tracing the lifespan of short-lived files ... Hit Ctrl-C to end.
TIME     PID    COMM  AGE(s)  FILE
08:56:30 13015  rm    5.17    /home/sda/git-repos/iovisor/bcc/libbpf-tools/a.out (1)
08:56:45 13075  rm    5.17    /home/sda/git-repos/iovisor/bcc/a.out              (2)

In fact, we do not need to record the cwd-dentry of the process that created the file. We only need to pass the dentry of the deleted file as the dentry parameter of bpf_dentry_full_path(). Of course, the vfsmount of cwd still needs to be obtained when creating it.

Fix: commit 74bddcb ("libbpf-tools/filelife: support full-path")

The process that creates the file and the process that deletes the file may
be two completely different processes, and their cwds are different. We get
the file name from the file dentry and concatenate the cwd to create the
full-path. If we use the dentry name of the deleted file + the cwd-dentry
of the process that created the file, we will get an incorrect full-path.
For example:

    $ realpath .
    /home/sda/git-repos/iovisor/bcc/libbpf-tools

    (1) correct full-path

    $ touch a.out               cwd_dentry = /home/sda/git-repos/iovisor/bcc/libbpf-tools
    $ cd ..
    $ rm libbpf-tools/a.out     dentry = a.out

    (2) wrong full-path

    $ touch libbpf-tools/a.out  cwd_dentry = /home/sda/git-repos/iovisor/bcc/
    $ cd libbpf-tools/
    $ rm a.out                  dentry = a.out

    $ sudo ./filelife -F
    Tracing the lifespan of short-lived files ... Hit Ctrl-C to end.
    TIME     PID    COMM  AGE(s)  FILE
    08:56:30 13015  rm    5.17    /home/sda/git-repos/iovisor/bcc/libbpf-tools/a.out (1)
    08:56:45 13075  rm    5.17    /home/sda/git-repos/iovisor/bcc/a.out              (2)

In fact, we do not need to record the cwd-dentry of the process that created
the file. We only need to pass the dentry of the deleted file as the dentry
parameter of bpf_dentry_full_path(). Of course, the vfsmount of cwd still
needs to be obtained when creating it.

Fix: commit 74bddcb ("libbpf-tools/filelife: support full-path")
Signed-off-by: Rong Tao <rongtao@cestc.cn>
@Rtoax Rtoax requested a review from yonghong-song July 4, 2025 01:40
@yonghong-song yonghong-song merged commit af21da6 into iovisor:master Jul 13, 2025
1 of 12 checks passed
ekyooo added a commit to ekyooo/bcc that referenced this pull request Jan 23, 2026
  * Support for kernel up to 6.18

  * New Tools
    tools/softirqslower: New tool to trace slow software interrupt handlers (iovisor#5356)

  * Enhanced Functionality
    libbpf-tools/opensnoop: Added full-path support with `-F` option (iovisor#5323, iovisor#5333)
    libbpf-tools/filelife: Added full-path support (iovisor#5347, ab8e061)
    libbpf-tools: Introduced path helpers (ab8e061)
    libbpf-tools/trace_helpers: Added str_loadavg() and str_timestamp() common functions (694de9f)
    libbpf-tools/filetop: Added directory filter capability (iovisor#5300)
    libbpf-tools/runqslower: Added `-c` option to filter by process name prefix (673911c)
    libbpf-tools/runqlat: Dynamically size pid/pidns histogram map (iovisor#5342)
    libbpf-tools/fsdist, fsslower: Added support for fuse filesystem (9691c56)
    libbpf-tools/tcptop: Major refactoring using fentry/fexit for better performance (75bb73a, e2c7917, d786eaa, da3a474)
    tools/opensnoop: Added full-path support with `-F` option (iovisor#5334, iovisor#5339)
    tools/kvmexit: Added AMD processor support and parallel post-processing (13a4e5a, c2af2ee)
    tools/offwaketime: Added raw tracepoint support to reduce overhead (380ee01)
    Python uprobe API: Added functionality to detach all uprobes for a binary (iovisor#5325)
    Python API: Added support for executing a program and tracing it (iovisor#5362)

  * Bug Fixes
    libbpf-tools/filelife: Fixed wrong full-path handling (iovisor#5347)
    libbpf-tools/filelife: Fixed problem when using perf-buffer (ec8415b)
    libbpf-tools/funclatency: Delete the element from the `starts` map after it has been used (06ce134)
    libbpf-tools/offcputime: Fixed min/max_block_ns unit conversion error (iovisor#5327, d507a53)
    libbpf-tools/syncsnoop: Added support for sync_file_range2 and arm_sync_file_range() (4287921)
    libbpf-tools/ksnoop: Fixed two invalid access to map value (iovisor#5361)
    libbpf-tools/klockstat: Allows kprobe fallback to work with lock debugging (iovisor#5359)
    libbpf-tools/biotop: Fixed segmentation fault with musl libc build (52d2d09)
    libbpf-tools/syscall_helpers, Python BCC: Updated syscall list (add file_getattr/file_setattr) (b63d7e3, a9c6650)
    tools/tcpaccept: Fixed on recent kernels (c208d0e)
    tools/tcpconnect: Fixed iov field for DNS with Linux>=6.4 (iovisor#5382)
    tools/javaobjnew: Use MIN macro instead of min function (fb8910a)
    tools/biolatency, biosnoop, biotop: Use TRACEPOINT_PROBE() for tracepoints (iovisor#5366)
    Various tools: Don't use the old bpf_probe_read() helper (1cc15c3)
    CC: Support versioned SONAME in shared library resolution (beb1fe4, c351210)
    Python TCP: Added state2str() and applied to tools (bfa05d2)
    s390 architecture: Prevent invalid mem access when reading PAGE_OFFSET (d8595ee)

  * Build & Test Fixes
    Fixed build failure with clang21 (iovisor#5369)
    Fixed build for LLVM 23 by avoiding deprecated TargetRegistry overloads (iovisor#5401)
    ci: Make version.cmake handle shallow clone (2232b7e)
    ci: Various test fixes for proper CI operation (blk probes, rss_stat, kmalloc, btrfs/f2fs) (a499181, c338547, 6b7dd5d, ea5cf83)
    tests: Added coverage for versioned SONAME resolution (c351210)
    Removed luajit options to ensure no errors (26eaf13)

  * Doc update, other bug fixes and tools improvement
ekyooo added a commit that referenced this pull request Jan 26, 2026
  * Support for kernel up to 6.18

  * New Tools
    tools/softirqslower: New tool to trace slow software interrupt handlers (#5356)

  * Enhanced Functionality
    libbpf-tools/opensnoop: Added full-path support with `-F` option (#5323, #5333)
    libbpf-tools/filelife: Added full-path support (#5347, ab8e061)
    libbpf-tools: Introduced path helpers (ab8e061)
    libbpf-tools/trace_helpers: Added str_loadavg() and str_timestamp() common functions (694de9f)
    libbpf-tools/filetop: Added directory filter capability (#5300)
    libbpf-tools/runqslower: Added `-c` option to filter by process name prefix (673911c)
    libbpf-tools/runqlat: Dynamically size pid/pidns histogram map (#5342)
    libbpf-tools/fsdist, fsslower: Added support for fuse filesystem (9691c56)
    libbpf-tools/tcptop: Major refactoring using fentry/fexit for better performance (75bb73a, e2c7917, d786eaa, da3a474)
    tools/opensnoop: Added full-path support with `-F` option (#5334, #5339)
    tools/kvmexit: Added AMD processor support and parallel post-processing (13a4e5a, c2af2ee)
    tools/offwaketime: Added raw tracepoint support to reduce overhead (380ee01)
    Python uprobe API: Added functionality to detach all uprobes for a binary (#5325)
    Python API: Added support for executing a program and tracing it (#5362)

  * Bug Fixes
    libbpf-tools/filelife: Fixed wrong full-path handling (#5347)
    libbpf-tools/filelife: Fixed problem when using perf-buffer (ec8415b)
    libbpf-tools/funclatency: Delete the element from the `starts` map after it has been used (06ce134)
    libbpf-tools/offcputime: Fixed min/max_block_ns unit conversion error (#5327, d507a53)
    libbpf-tools/syncsnoop: Added support for sync_file_range2 and arm_sync_file_range() (4287921)
    libbpf-tools/ksnoop: Fixed two invalid access to map value (#5361)
    libbpf-tools/klockstat: Allows kprobe fallback to work with lock debugging (#5359)
    libbpf-tools/biotop: Fixed segmentation fault with musl libc build (52d2d09)
    libbpf-tools/syscall_helpers, Python BCC: Updated syscall list (add file_getattr/file_setattr) (b63d7e3, a9c6650)
    tools/tcpaccept: Fixed on recent kernels (c208d0e)
    tools/tcpconnect: Fixed iov field for DNS with Linux>=6.4 (#5382)
    tools/javaobjnew: Use MIN macro instead of min function (fb8910a)
    tools/biolatency, biosnoop, biotop: Use TRACEPOINT_PROBE() for tracepoints (#5366)
    Various tools: Don't use the old bpf_probe_read() helper (1cc15c3)
    CC: Support versioned SONAME in shared library resolution (beb1fe4, c351210)
    Python TCP: Added state2str() and applied to tools (bfa05d2)
    s390 architecture: Prevent invalid mem access when reading PAGE_OFFSET (d8595ee)

  * Build & Test Fixes
    Fixed build failure with clang21 (#5369)
    Fixed build for LLVM 23 by avoiding deprecated TargetRegistry overloads (#5401)
    ci: Make version.cmake handle shallow clone (2232b7e)
    ci: Various test fixes for proper CI operation (blk probes, rss_stat, kmalloc, btrfs/f2fs) (a499181, c338547, 6b7dd5d, ea5cf83)
    tests: Added coverage for versioned SONAME resolution (c351210)
    Removed luajit options to ensure no errors (26eaf13)

  * Doc update, other bug fixes and tools improvement
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants