Skip to content

feat(rocprofiler-sdk): validate rocattach pathname lookup by GNU Build ID when device/inode does not match - #9529

Open
mcao59 wants to merge 7 commits into
developfrom
users/mcao/attach-container
Open

feat(rocprofiler-sdk): validate rocattach pathname lookup by GNU Build ID when device/inode does not match#9529
mcao59 wants to merge 7 commits into
developfrom
users/mcao/attach-container

Conversation

@mcao59

@mcao59 mcao59 commented Jul 30, 2026

Copy link
Copy Markdown
Member

Motivation

When rocattach resolves a symbol in a target process, it first attempts to open the exact mapped ELF through /proc/<pid>/map_files

That path may be unavailable because of kernel configuration or capability restrictions. rocattach then falls back to opening the mapped pathname through /proc/<pid>/root.

In OverlayFS containers, the device and inode reported by /proc/<pid>/maps can describe the underlying backing file, while /proc/<pid>/root opens the overlay-visible file. The two paths may therefore refer to the same ELF content while reporting different device/inode metadata, causing the existing fallback to reject valid container attachment.

This change preserves device/inode equality as the fast path and validates a metadata-mismatched /proc/<pid>/root fallback by comparing the candidate ELF’s GNU Build ID with the Build ID in the target’s currently mapped image.

Technical Details

symbol_lookup.cpp

  • Preserve /proc/<pid>/map_files with strict device/inode validation as the preferred path.
  • Fall back to /proc/<pid>/root/<mapped-path> when map_files is unavailable.
  • On device/inode mismatch:
    • Read the GNU Build ID from the candidate ELF and the target’s mapped image.
    • Accept the fallback only when the Build IDs match.
  • Apply consistent PT_NOTE validation to both file and memory reads.

symbol_lookup.hpp

  • Add an internal option for tests to bypass map_files and directly exercise the pathname fallback.

tests/rocattach

  • Add cross-process coverage for matching, mismatched, and missing Build IDs.
  • Verify exact device/inode matches do not require a Build ID.
  • Verify unrelated mappings of the same inode do not affect resolution.

Issue Tracking

JIRA ID: ROCM-28593

Test Plan

Added new tests in tests/rocattach

Test Result

New and existing tests pass

Submission Checklist

@therock-pr-bot

Copy link
Copy Markdown

✅ All Policy Checks Passed

Check Status Details
📝 PR Description ✅ Pass
Forbidden Files ✅ Pass
🧪 Unit Test ✅ Pass
🚫 Draft PR 🔜 To Be Enabled
🚩 Feature Flag 🔜 To Be Enabled
📊 Code Coverage 🔜 To Be Enabled

🎉 All policy checks passed!

📖 Need help? See the Policy FAQ for details on every check and how to fix failures.

🙋 Wish to Override Policy?

@mcao59
mcao59 force-pushed the users/mcao/attach-container branch from 4e7961c to d53f001 Compare July 30, 2026 23:12
@vedithal-amd

Copy link
Copy Markdown
Contributor

Verified this fixes the failure.

Same target process, only ROCPROF_ATTACH_LIBRARY varied between runs:

  • develop: Refusing to use ... device/inode does not match (symbol_lookup.cpp:436), then status 1.
  • this PR: attaches and detaches cleanly via the /proc/<pid>/root fallback, 9810 kernel dispatch records captured.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants