Problem on Ubuntu 24.04 LTS

[bernyspeedy]

It does not seem to work on top of bcc 0.30.0 on Ubuntu 24.04 LTS and Python 3.12.3.
It would be very kind, if you could give me a hint, where should have to look for.

When starting unixdump, the following error is displayed:

b"/virtual/main.c:403:15: error: no member named 'hash' in 'struct unix_address'\n 403 | if (addr->hash < UNIX_HASH_SIZE) {\n | ~~~~ ^\n/virtual/main.c:506:30: error: no member named 'iov' in 'struct iov_iter'\n 506 | size_t len = msg->msg_iter.iov->iov_len;\n | ~~~~~~~~~~~~~ ^\n/virtual/main.c:507:30: error: no member named 'iov' in 'struct iov_iter'\n 507 | void* base = msg->msg_iter.iov->iov_base;\n | ~~~~~~~~~~~~~ ^\n/virtual/main.c:1051:30: error: no member named 'iov' in 'struct iov_iter'\n 1051 | size_t len = msg->msg_iter.iov->iov_len;\n | ~~~~~~~~~~~~~ ^\n/virtual/main.c:1052:30: error: no member named 'iov' in 'struct iov_iter'\n 1052 | void* base = msg->msg_iter.iov->iov_base;\n | ~~~~~~~~~~~~~ ^\n5 errors generated.\n"
Failed to compile BPF module

[ssooffiiaannee]

I face the same problem, any updates on this ?

[valpackett]

The hash field is gone since torvalds/linux@e6b4b87 – can be fixed like so:

--- i/unixdump/unixdump/__init__.py
+++ w/unixdump/unixdump/__init__.py
@@ -739,15 +742,11 @@ int kprobe__unix_stream_sendmsg(struct pt_regs *ctx, struct socket *sock, struct
     #if !defined(FILTER_UNIX) || defined(BEGINS_WITH)
     n.u.fill[13] = 0;
     #endif
-    if (addr->hash < UNIX_HASH_SIZE) {
-      bpf_probe_read(sun_path_ptr, UNIX_PATH_MAX, addr->name->sun_path);
+    bpf_probe_read(sun_path_ptr, UNIX_PATH_MAX, addr->name->sun_path);
+    if (sun_path_ptr[0] == '\\0')
       sun_path_ptr[0] = '@';
-    } else {
-      if (n.sun_path_len > 0) {
-        n.sun_path_len -= 1;
-      }
-      bpf_probe_read(sun_path_ptr, UNIX_PATH_MAX, addr->name->sun_path);
-    }
+    else
+      n.sun_path_len -= 1;
     sun_path_ptr[UNIX_PATH_MAX] = '\\0';
   } else {
     #if !defined(FILTER_UNIX) || defined(BEGINS_WITH)

Then there's error: no member named 'iov' in 'struct iov_iter'

@@ -842,8 +841,8 @@ int kprobe__unix_stream_sendmsg(struct pt_regs *ctx, struct socket *sock, struct
   }
 
 
-  size_t len = msg->msg_iter.iov->iov_len;
-  void* base = msg->msg_iter.iov->iov_base;
+  size_t len = msg->msg_iter.__ubuf_iovec.iov_len;
+  void* base = msg->msg_iter.__ubuf_iovec.iov_base;
 
   //note: reporting 0 length writes may identify ancillary data
   /*if (len == 0) {
@@ -1261,8 +1260,8 @@ int kprobe__unix_dgram_sendmsg(struct pt_regs *ctx, struct socket *sock, struct
   }
 
 
-  size_t len = msg->msg_iter.iov->iov_len;
-  void* base = msg->msg_iter.iov->iov_base;
+  size_t len = msg->msg_iter.__ubuf_iovec.iov_len;
+  void* base = msg->msg_iter.__ubuf_iovec.iov_base;
 
   //note: reporting 0 length writes may identify ancillary data
   /*if (len == 0) {

(and since we're reading userspace addresses, you proooobably need to explicitly read_user for it to work on GCC-built kernels, though it's autodetected on clang-built ones:)

@@ -547,7 +550,7 @@ inline static void copy_into_entry_buffer(data_t* entry, size_t const len, char*
   if (l >= BUFFER_SIZE) {
     l = BUFFER_SIZE - 1;
   }
-  bpf_probe_read(entry->buffer, l, base);
+  bpf_probe_read_user(entry->buffer, l, base);
 }
 
 static inline struct cmsghdr* cmsg_firsthdr_x(struct msghdr* msg) {

Then I hit the errors related to the unix_sk macro (a simple container_of, but expanded to uhh this)…

/virtual/main.c:349:143: error: expected expression
  349 |   struct unix_sock* us = ({ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *){ typeof(struct sock) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)nix_sk); _val; })); _val; })); _val; })); _val; })); _val; })(sk);
      |                                                                                                                                               ^
/virtual/main.c:349:625: error: expected '}'

Thankfully it is the first field so we can simplify container_of down to a cast:

@@ -369,6 +369,9 @@ def main():
 #define RING_SIZE ((size_t){{RING_SIZE}})
 #define NUM_CPU ((size_t){{cores}})
 
+#undef unix_sk
+#define unix_sk(x) (struct unix_sock*)(x)
+
 typedef struct data {
   volatile size_t used;
   //volatile size_t len;

Then just a couple instances of this:

/virtual/main.c:364:155: error: arithmetic on a pointer to an incomplete type 'struct upid[]'
  364 |     n.peer_pid = ({ typeof(struct upid) _val; __builtin_memset(&_val, 0, sizeof(_val)); bpf_probe_read(&_val, sizeof(_val), (void *)((&peer_pid->numbers) + (0))); _val; }).nr;
      |                                                                                                                                      ~~~~~~~~~~~~~~~~~~~~ ^

welp, let's make it not do arithmetic with 0:

@@ -662,7 +665,7 @@ int kprobe__unix_stream_sendmsg(struct pt_regs *ctx, struct socket *sock, struct
   struct pid* peer_pid = sk->sk_peer_pid;
   if (peer_pid != NULL) {
     //n.peer_pid = pid_nr(peer_pid);
-    n.peer_pid = peer_pid->numbers[0].nr;
+    n.peer_pid = peer_pid->numbers->nr;
   }
 
   #ifdef EXCLUDE_PIDS
@@ -1013,7 +1010,7 @@ int kprobe__unix_dgram_sendmsg(struct pt_regs *ctx, struct socket *sock, struct
   struct pid* peer_pid = sk->sk_peer_pid;
   if (peer_pid != NULL) {
     //n.peer_pid = pid_nr(peer_pid);
-    n.peer_pid = peer_pid->numbers[0].nr;
+    n.peer_pid = peer_pid->numbers->nr;
   }
 
   #ifdef EXCLUDE_PIDS

And with that, it seems to work for me on Linux 6.16.0-rc1-next! \o/

====
STREAM PID 3109936.0xffff0008266efa00 (C) > 1712.0xffff00080270ff00 (S), length 80
command[   1712]: b'/usr/bin/gnome-shell'
----
00000000: 52 00 00 00 02 00 24 00  17 00 00 00 68 78 20 68  R.....$.....hx h
00000010: 65 6C 6C 6F 5F 77 61 79  6C 61 6E 64 2E 6F 77 6F  ello_wayland.owo
00000020: 20 7E 00 00 2E 00 00 00  03 00 0C 00 6A 00 00 00   ~..........j...
00000030: 1C 00 00 00 01 00 10 00  2E 00 00 00 71 00 00 00  ............q...
00000040: 2E 00 00 00 0A 00 10 00  00 00 00 00 00 00 00 00  ................

====
STREAM PID 3112537.0xffff000bebf02300 (C) > 1712.0xffff000818151200 (S), length 112
command[3112537]: b'glmark2-es2-wayland'
command[   1712]: b'/usr/bin/gnome-shell'
ancillary data sent (attempted): 1 CMSG observed
  SCM_RIGHTS: FD 5, /memfd:mutter-shared (deleted)'

----
00000000: 09 00 00 00 00 00 0C 00  07 00 00 00 09 00 00 00  ................
00000010: 01 00 0C 00 03 00 00 00  04 00 00 00 00 00 0C 00  ................
00000020: 0A 00 00 00 05 00 00 00  00 00 10 00 0B 00 00 00  ................
00000030: 00 10 00 00 0B 00 00 00  02 00 0C 00 80 22 00 00  ............."..
00000040: 0B 00 00 00 02 00 0C 00  C0 48 00 00 0B 00 00 00  .........H......
00000050: 02 00 0C 00 80 95 00 00  01 00 00 00 01 00 0C 00  ................
00000060: 0C 00 00 00 01 00 00 00  00 00 0C 00 0D 00 00 00  ................

[KrystianGora]

Applying @valpackett patches resolves the issue for kernel 6.6 at least. I merged it into the one patch:

--- a/unixdump/__init__.py
+++ b/unixdump/__init__.py
@@ -369,6 +369,9 @@
 #define RING_SIZE ((size_t){{RING_SIZE}})
 #define NUM_CPU ((size_t){{cores}})

+#undef unix_sk
+#define unix_sk(x) (struct unix_sock*)(x)
+
 typedef struct data {
   volatile size_t used;
   //volatile size_t len;
@@ -547,7 +550,7 @@
   if (l >= BUFFER_SIZE) {
     l = BUFFER_SIZE - 1;
   }
-  bpf_probe_read(entry->buffer, l, base);
+  bpf_probe_read_user(entry->buffer, l, base);
 }

 static inline struct cmsghdr* cmsg_firsthdr_x(struct msghdr* msg) {
@@ -662,7 +665,7 @@
   struct pid* peer_pid = sk->sk_peer_pid;
   if (peer_pid != NULL) {
     //n.peer_pid = pid_nr(peer_pid);
-    n.peer_pid = peer_pid->numbers[0].nr;
+    n.peer_pid = peer_pid->numbers->nr;
   }

   #ifdef EXCLUDE_PIDS
@@ -739,15 +742,11 @@
     #if !defined(FILTER_UNIX) || defined(BEGINS_WITH)
     n.u.fill[13] = 0;
     #endif
-    if (addr->hash < UNIX_HASH_SIZE) {
-      bpf_probe_read(sun_path_ptr, UNIX_PATH_MAX, addr->name->sun_path);
+    bpf_probe_read(sun_path_ptr, UNIX_PATH_MAX, addr->name->sun_path);
+    if (sun_path_ptr[0] == '\\0')
       sun_path_ptr[0] = '@';
-    } else {
-      if (n.sun_path_len > 0) {
-        n.sun_path_len -= 1;
-      }
-      bpf_probe_read(sun_path_ptr, UNIX_PATH_MAX, addr->name->sun_path);
-    }
+    else
+      n.sun_path_len -= 1;
     sun_path_ptr[UNIX_PATH_MAX] = '\\0';
   } else {
     #if !defined(FILTER_UNIX) || defined(BEGINS_WITH)
@@ -842,8 +841,8 @@
   }


-  size_t len = msg->msg_iter.iov->iov_len;
-  void* base = msg->msg_iter.iov->iov_base;
+  size_t len = msg->msg_iter.__ubuf_iovec.iov_len;
+  void* base = msg->msg_iter.__ubuf_iovec.iov_base;

   //note: reporting 0 length writes may identify ancillary data
   /*if (len == 0) {
@@ -1013,7 +1012,7 @@
   struct pid* peer_pid = sk->sk_peer_pid;
   if (peer_pid != NULL) {
     //n.peer_pid = pid_nr(peer_pid);
-    n.peer_pid = peer_pid->numbers[0].nr;
+    n.peer_pid = peer_pid->numbers->nr;
   }

   #ifdef EXCLUDE_PIDS
@@ -1261,8 +1260,8 @@
   }


-  size_t len = msg->msg_iter.iov->iov_len;
-  void* base = msg->msg_iter.iov->iov_base;
+  size_t len = msg->msg_iter.__ubuf_iovec.iov_len;
+  void* base = msg->msg_iter.__ubuf_iovec.iov_base;

   //note: reporting 0 length writes may identify ancillary data
   /*if (len == 0) {