libbpf-tools/filelife: Fix wrong full-path#5347
Merged
yonghong-song merged 1 commit intoiovisor:masterfrom Jul 13, 2025
Merged
Conversation
The process that creates the file and the process that deletes the file may
be two completely different processes, and their cwds are different. We get
the file name from the file dentry and concatenate the cwd to create the
full-path. If we use the dentry name of the deleted file + the cwd-dentry
of the process that created the file, we will get an incorrect full-path.
For example:
$ realpath .
/home/sda/git-repos/iovisor/bcc/libbpf-tools
(1) correct full-path
$ touch a.out cwd_dentry = /home/sda/git-repos/iovisor/bcc/libbpf-tools
$ cd ..
$ rm libbpf-tools/a.out dentry = a.out
(2) wrong full-path
$ touch libbpf-tools/a.out cwd_dentry = /home/sda/git-repos/iovisor/bcc/
$ cd libbpf-tools/
$ rm a.out dentry = a.out
$ sudo ./filelife -F
Tracing the lifespan of short-lived files ... Hit Ctrl-C to end.
TIME PID COMM AGE(s) FILE
08:56:30 13015 rm 5.17 /home/sda/git-repos/iovisor/bcc/libbpf-tools/a.out (1)
08:56:45 13075 rm 5.17 /home/sda/git-repos/iovisor/bcc/a.out (2)
In fact, we do not need to record the cwd-dentry of the process that created
the file. We only need to pass the dentry of the deleted file as the dentry
parameter of bpf_dentry_full_path(). Of course, the vfsmount of cwd still
needs to be obtained when creating it.
Fix: commit 74bddcb ("libbpf-tools/filelife: support full-path")
Signed-off-by: Rong Tao <rongtao@cestc.cn>
ekyooo
added a commit
to ekyooo/bcc
that referenced
this pull request
Jan 23, 2026
* Support for kernel up to 6.18
* New Tools
tools/softirqslower: New tool to trace slow software interrupt handlers (iovisor#5356)
* Enhanced Functionality
libbpf-tools/opensnoop: Added full-path support with `-F` option (iovisor#5323, iovisor#5333)
libbpf-tools/filelife: Added full-path support (iovisor#5347, ab8e061)
libbpf-tools: Introduced path helpers (ab8e061)
libbpf-tools/trace_helpers: Added str_loadavg() and str_timestamp() common functions (694de9f)
libbpf-tools/filetop: Added directory filter capability (iovisor#5300)
libbpf-tools/runqslower: Added `-c` option to filter by process name prefix (673911c)
libbpf-tools/runqlat: Dynamically size pid/pidns histogram map (iovisor#5342)
libbpf-tools/fsdist, fsslower: Added support for fuse filesystem (9691c56)
libbpf-tools/tcptop: Major refactoring using fentry/fexit for better performance (75bb73a, e2c7917, d786eaa, da3a474)
tools/opensnoop: Added full-path support with `-F` option (iovisor#5334, iovisor#5339)
tools/kvmexit: Added AMD processor support and parallel post-processing (13a4e5a, c2af2ee)
tools/offwaketime: Added raw tracepoint support to reduce overhead (380ee01)
Python uprobe API: Added functionality to detach all uprobes for a binary (iovisor#5325)
Python API: Added support for executing a program and tracing it (iovisor#5362)
* Bug Fixes
libbpf-tools/filelife: Fixed wrong full-path handling (iovisor#5347)
libbpf-tools/filelife: Fixed problem when using perf-buffer (ec8415b)
libbpf-tools/funclatency: Delete the element from the `starts` map after it has been used (06ce134)
libbpf-tools/offcputime: Fixed min/max_block_ns unit conversion error (iovisor#5327, d507a53)
libbpf-tools/syncsnoop: Added support for sync_file_range2 and arm_sync_file_range() (4287921)
libbpf-tools/ksnoop: Fixed two invalid access to map value (iovisor#5361)
libbpf-tools/klockstat: Allows kprobe fallback to work with lock debugging (iovisor#5359)
libbpf-tools/biotop: Fixed segmentation fault with musl libc build (52d2d09)
libbpf-tools/syscall_helpers, Python BCC: Updated syscall list (add file_getattr/file_setattr) (b63d7e3, a9c6650)
tools/tcpaccept: Fixed on recent kernels (c208d0e)
tools/tcpconnect: Fixed iov field for DNS with Linux>=6.4 (iovisor#5382)
tools/javaobjnew: Use MIN macro instead of min function (fb8910a)
tools/biolatency, biosnoop, biotop: Use TRACEPOINT_PROBE() for tracepoints (iovisor#5366)
Various tools: Don't use the old bpf_probe_read() helper (1cc15c3)
CC: Support versioned SONAME in shared library resolution (beb1fe4, c351210)
Python TCP: Added state2str() and applied to tools (bfa05d2)
s390 architecture: Prevent invalid mem access when reading PAGE_OFFSET (d8595ee)
* Build & Test Fixes
Fixed build failure with clang21 (iovisor#5369)
Fixed build for LLVM 23 by avoiding deprecated TargetRegistry overloads (iovisor#5401)
ci: Make version.cmake handle shallow clone (2232b7e)
ci: Various test fixes for proper CI operation (blk probes, rss_stat, kmalloc, btrfs/f2fs) (a499181, c338547, 6b7dd5d, ea5cf83)
tests: Added coverage for versioned SONAME resolution (c351210)
Removed luajit options to ensure no errors (26eaf13)
* Doc update, other bug fixes and tools improvement
ekyooo
added a commit
that referenced
this pull request
Jan 26, 2026
* Support for kernel up to 6.18
* New Tools
tools/softirqslower: New tool to trace slow software interrupt handlers (#5356)
* Enhanced Functionality
libbpf-tools/opensnoop: Added full-path support with `-F` option (#5323, #5333)
libbpf-tools/filelife: Added full-path support (#5347, ab8e061)
libbpf-tools: Introduced path helpers (ab8e061)
libbpf-tools/trace_helpers: Added str_loadavg() and str_timestamp() common functions (694de9f)
libbpf-tools/filetop: Added directory filter capability (#5300)
libbpf-tools/runqslower: Added `-c` option to filter by process name prefix (673911c)
libbpf-tools/runqlat: Dynamically size pid/pidns histogram map (#5342)
libbpf-tools/fsdist, fsslower: Added support for fuse filesystem (9691c56)
libbpf-tools/tcptop: Major refactoring using fentry/fexit for better performance (75bb73a, e2c7917, d786eaa, da3a474)
tools/opensnoop: Added full-path support with `-F` option (#5334, #5339)
tools/kvmexit: Added AMD processor support and parallel post-processing (13a4e5a, c2af2ee)
tools/offwaketime: Added raw tracepoint support to reduce overhead (380ee01)
Python uprobe API: Added functionality to detach all uprobes for a binary (#5325)
Python API: Added support for executing a program and tracing it (#5362)
* Bug Fixes
libbpf-tools/filelife: Fixed wrong full-path handling (#5347)
libbpf-tools/filelife: Fixed problem when using perf-buffer (ec8415b)
libbpf-tools/funclatency: Delete the element from the `starts` map after it has been used (06ce134)
libbpf-tools/offcputime: Fixed min/max_block_ns unit conversion error (#5327, d507a53)
libbpf-tools/syncsnoop: Added support for sync_file_range2 and arm_sync_file_range() (4287921)
libbpf-tools/ksnoop: Fixed two invalid access to map value (#5361)
libbpf-tools/klockstat: Allows kprobe fallback to work with lock debugging (#5359)
libbpf-tools/biotop: Fixed segmentation fault with musl libc build (52d2d09)
libbpf-tools/syscall_helpers, Python BCC: Updated syscall list (add file_getattr/file_setattr) (b63d7e3, a9c6650)
tools/tcpaccept: Fixed on recent kernels (c208d0e)
tools/tcpconnect: Fixed iov field for DNS with Linux>=6.4 (#5382)
tools/javaobjnew: Use MIN macro instead of min function (fb8910a)
tools/biolatency, biosnoop, biotop: Use TRACEPOINT_PROBE() for tracepoints (#5366)
Various tools: Don't use the old bpf_probe_read() helper (1cc15c3)
CC: Support versioned SONAME in shared library resolution (beb1fe4, c351210)
Python TCP: Added state2str() and applied to tools (bfa05d2)
s390 architecture: Prevent invalid mem access when reading PAGE_OFFSET (d8595ee)
* Build & Test Fixes
Fixed build failure with clang21 (#5369)
Fixed build for LLVM 23 by avoiding deprecated TargetRegistry overloads (#5401)
ci: Make version.cmake handle shallow clone (2232b7e)
ci: Various test fixes for proper CI operation (blk probes, rss_stat, kmalloc, btrfs/f2fs) (a499181, c338547, 6b7dd5d, ea5cf83)
tests: Added coverage for versioned SONAME resolution (c351210)
Removed luajit options to ensure no errors (26eaf13)
* Doc update, other bug fixes and tools improvement
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The process that creates the file and the process that deletes the file may be two completely different processes, and their cwds are different. We get the file name from the file dentry and concatenate the cwd to create the full-path. If we use the dentry name of the deleted file + the cwd-dentry of the process that created the file, we will get an incorrect full-path. For example:
In fact, we do not need to record the cwd-dentry of the process that created the file. We only need to pass the dentry of the deleted file as the dentry parameter of bpf_dentry_full_path(). Of course, the vfsmount of cwd still needs to be obtained when creating it.
Fix: commit 74bddcb ("libbpf-tools/filelife: support full-path")