Confirmed that I could repro.
I kprobed into __alloc_fd, it seems the extra socket FDs are allocated
in annotate_prog_tag:
1209030 1209030 test_leak __alloc_fd 6
kretprobe_trampoline+0x0 [kernel]
SyS_socket+0x6f [kernel]
do_syscall_64+0x53 [kernel]
return_from_SYSCALL_64+0x0 [kernel]
__GI___socket+0x7 [libc-2.17.so]
ebpf::BPFModule::annotate_prog_tag(std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> > const&, int, bpf_insn*,
int)+0x2a [test_leak]
[unknown]
1209030 1209030 test_leak __alloc_fd 7
kretprobe_trampoline+0x0 [kernel]
SYSC_accept4+0xca [kernel]
sys_accept+0x10 [kernel]
do_syscall_64+0x53 [kernel]
return_from_SYSCALL_64+0x0 [kernel]
__accept_nocancel+0x7 [libpthread-2.17.so]
ebpf::BPFModule::annotate_prog_tag(std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> > const&, int, bpf_insn*,
int)+0x2a [test_leak]
[unknown]
If no one has any idea directly off their mind, I will try debug this tomorrow:)
On Tue, Mar 13, 2018 at 9:38 PM, Mauricio Vasquez via iovisor-dev
<[email protected]> wrote:
> Dear All,
>
> One of our applications is giving errors because there are many file
> descriptors open. After some debugging we found that bcc appears to be
> leaking file descriptors.
>
> Please considerer the following example where a very simple ebpf program is
> compiled and then it is loaded and unloaded some times:
>
> $ cat <<EOF >test_fd_leakage.cpp
>
> #include <bcc/BPF.h>
> #include <iostream>
>
> const std::string BPF_PROGRAM0 = R"(
> //int handle_rx(struct xdp_md *ctx) {
> // return XDP_PASS;
> //}
> int handle_rx(struct __sk_buff *skb) {
> return 0;
> }
> )";
>
> int main(void) {
> ebpf::StatusTuple res(0);
> ebpf::BPF bpf;
> int fd;
>
> std::cout << "PID=" << getpid() << std::endl;
>
> res = bpf.init(BPF_PROGRAM0);
> if (res.code() != 0) {
> std::cout << "failed to init XDP program: {0}" << res.msg() <<
> std::endl;
> return -1;
> }
>
> for (int i = 0; i < 10; i++) {
> //res = bpf.load_func("handle_rx", BPF_PROG_TYPE_XDP, fd);
> res = bpf.load_func("handle_rx", BPF_PROG_TYPE_SCHED_CLS, fd);
> if (res.code() != 0) {
> std::cout << "failed to load XDP program: {0}" << res.msg() <<
> std::endl;
> return -1;
> }
>
> res = bpf.unload_func("handle_rx");
> if (res.code() != 0) {
> std::cout << "failed to unload XDP program: {0}" << res.msg() <<
> std::endl;
> return -1;
> }
> }
>
> std::cout << "about to close " << std::endl;
> getchar();
>
> return 0;
> }
>
> EOF
>
> $ g++ -o test_fd_leakage test_fd_leakage.cpp --std=c++11 -lbcc
>
> $ sudo ./test_fd_leakage
>
>
> Before closing the program:
>
> $ sudo ls -la /proc/$PID/fd
> total 0
> dr-x------ 2 root root 0 Mar 13 23:23 .
> dr-xr-xr-x 9 root root 0 Mar 13 23:23 ..
> lrwx------ 1 root root 64 Mar 13 23:23 0 -> /dev/pts/7
> lrwx------ 1 root root 64 Mar 13 23:23 1 -> /dev/pts/7
> lrwx------ 1 root root 64 Mar 13 23:23 10 -> socket:[1728287]
> lrwx------ 1 root root 64 Mar 13 23:23 11 -> socket:[1728288]
> lrwx------ 1 root root 64 Mar 13 23:23 12 -> socket:[1728289]
> lrwx------ 1 root root 64 Mar 13 23:23 13 -> socket:[1728290]
> lrwx------ 1 root root 64 Mar 13 23:23 14 -> socket:[1728291]
> lrwx------ 1 root root 64 Mar 13 23:23 15 -> socket:[1728292]
> lrwx------ 1 root root 64 Mar 13 23:23 16 -> socket:[1728293]
> lrwx------ 1 root root 64 Mar 13 23:23 17 -> socket:[1728294]
> lrwx------ 1 root root 64 Mar 13 23:23 18 -> socket:[1728295]
> lrwx------ 1 root root 64 Mar 13 23:23 19 -> socket:[1728296]
> lrwx------ 1 root root 64 Mar 13 23:23 2 -> /dev/pts/7
> lrwx------ 1 root root 64 Mar 13 23:23 20 -> socket:[1728297]
> lrwx------ 1 root root 64 Mar 13 23:23 21 -> socket:[1728298]
> lrwx------ 1 root root 64 Mar 13 23:23 22 -> socket:[1728299]
> lrwx------ 1 root root 64 Mar 13 23:23 23 -> socket:[1728300]
> lrwx------ 1 root root 64 Mar 13 23:23 4 -> socket:[1728279]
> lrwx------ 1 root root 64 Mar 13 23:23 5 -> socket:[1728280]
> lrwx------ 1 root root 64 Mar 13 23:23 6 -> socket:[1728283]
> lrwx------ 1 root root 64 Mar 13 23:23 7 -> socket:[1728284]
> lrwx------ 1 root root 64 Mar 13 23:23 8 -> socket:[1728285]
> lrwx------ 1 root root 64 Mar 13 23:23 9 -> socket:[1728286]
>
> The number of "socket:[xxxxxxx]" file descriptors is twice the number of
> iterations of the for loop in the test program.
>
> I am using kernel 4.16rc4 and bcc 7cfb73b.
>
> Does somebody have an idea of what is causing this?
>
>
> Thanks in advance,
>
> Mauricio
>
> _______________________________________________
> iovisor-dev mailing list
> [email protected]
> https://lists.iovisor.org/mailman/listinfo/iovisor-dev
_______________________________________________
iovisor-dev mailing list
[email protected]
https://lists.iovisor.org/mailman/listinfo/iovisor-dev
