parca-agent icon indicating copy to clipboard operation
parca-agent copied to clipboard

Handle local filesystem debuginfo discovery relative path case

Open brancz opened this issue 2 years ago • 3 comments

I recently came across a case where I originally thought it was an issue with the project, but it turns out to be a case where Parca Agent doesn't handle a specific case of debuginfo discovery on a local filesystem.

In this particular case it was about discovering the locally available libc debuginfo from Redpanda. When reading the .gnu_debuglink it returned this:

$ readelf --hex-dump=.gnu_debuglink /proc/25357/root/opt/redpanda/lib/libc.so.6

Hex dump of section '.gnu_debuglink':
  0x00000000 37623936 64666238 33663062 64636236 7b96dfb83f0bdcb6
  0x00000010 61343130 34363962 38326638 36343135 a410469b82f86415
  0x00000020 65356164 61332e64 65627567 00000000 e5ada3.debug....
  0x00000030 21c5dc99                            !...

It says 7b96dfb83f0bdcb6a410469b82f86415e5ada3.debug, which seemed inconsistent with the Build ID of the shared library:

$ readelf --hex-dump=.note.gnu.build-id /proc/25357/root/opt/redpanda/lib/libc.so.6

Hex dump of section '.note.gnu.build-id':
  0x000003a0 04000000 14000000 03000000 474e5500 ............GNU.
  0x000003b0 6e7b96df b83f0bdc b6a41046 9b82f864 n{...?.....F...d
  0x000003c0 15e5ada3                            ....

Which says 6e7b96dfb83f0bdcb6a410469b82f86415e5ada3.

I thought this was incorrect, but it turns out .gnu_debuglink can also be meant as a relative path. Meaning it was trying to tell us to search for the file 7b96dfb83f0bdcb6a410469b82f86415e5ada3.debug. And we should have known the 6e prefix directory from the Build ID.

brancz avatar Mar 06 '23 13:03 brancz

Isn't it this case?

https://github.com/parca-dev/parca-agent/blob/68ecbac6dc8d30f3e59df93d8c1f27c1ef2b0a7f/pkg/debuginfo/find.go#L222

maxbrunet avatar Mar 07 '23 21:03 maxbrunet

The current implementation should have covered the relative path. I wonder what I've missed 🤔 ?

kakkoyun avatar Mar 09 '23 07:03 kakkoyun

Can we write a test for the exact setup? During testing it definitely did not work. Also while that case may be able to find it, it does not actually use whatever the .gnu_debuglink contains, it just does what we think it should contain.

brancz avatar Mar 13 '23 12:03 brancz