tests: call.strcontains fails constantly on Linux v6.10

[piso77]

Issue:
call.strcontains fails constantly on v6.10

Bpftrace:
upstream built (HEAD @ 6cc2798 "Codegen Tests: Remove unnecessary uses of count() function"), but the same issue is present in 20.2, and 21.0.

Linux kernel:
v6.10-rc7, using x86-64_defconfig + bpftrace mandatory CONFIG options, but the same issue is 100% reproducible with e.g. 6.8.y

$ sudo ./runtime-tests.sh --filter=call.strcontains
...
[==========] Running 2 tests from 1 test cases.

[----------] 2 tests from call
[ RUN      ] call.strcontains
[  FAILED  ] call.strcontains
	Command: /home/ubuntu/bpftrace/upstream/build/src/bpftrace -ve 'kfunc:filp_close { $f = path(args.filp->f_path); if (strcontains($f, "tmp")) { printf("OK\n"); exit(); } }'
	Unclean exit code: 255
	Output: AST node count: 19\nAttaching 1 probe...\nERROR: Error loading BPF program for kfunc_vmlinux_filp_close_1.\nKernel error log: \nTracing programs must provide btf_id\nprocessed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0\n\n\nERROR: Loading BPF object(s) failed.\n
[ RUN      ] call.strcontains literals
[       OK ] call.strcontains literals
[----------] 2 tests from call

[==========] 2 tests from 1 test cases ran. (1383 ms total)
[  PASSED  ] 1 tests.
[  FAILED  ] 1 tests, listed below:
[  FAILED  ] call.strcontains

bpftrace --info output

ubuntu@pepe:~/bpftrace/upstream/build/tests$ sudo ../src/bpftrace --info
System
  OS: Linux 6.10.0-rc7-00076-g9d9a2f29aefd #8 SMP PREEMPT_DYNAMIC Mon Jul 15 10:40:50 UTC 2024
  Arch: x86_64

Build
  version: v0.21.0-35-g6cc2
  LLVM: 18.1.8
  unsafe probe: no
  bfd: no
  liblldb (DWARF support): no
  libsystemd (systemd notify support): no

Kernel helpers
  probe_read: yes
  probe_read_str: yes
  probe_read_user: yes
  probe_read_user_str: yes
  probe_read_kernel: yes
  probe_read_kernel_str: yes
  get_current_cgroup_id: yes
  send_signal: yes
  override_return: no
  get_boot_ns: yes
  dpath: yes
  skboutput: yes
  get_tai_ns: yes
  get_func_ip: yes
  jiffies64: yes
  for_each_map_elem: yes

Kernel features
  Instruction limit: 1000000
  Loop support: yes
  btf: yes
  module btf: yes
  map batch: yes
  uprobe refcount (depends on Build:bcc bpf_attach_uprobe refcount): yes

Map types
  hash: yes
  percpu hash: yes
  array: yes
  percpu array: yes
  stack_trace: yes
  perf_event_array: yes
  ringbuf: yes

Probe types
  kprobe: yes
  tracepoint: yes
  perf_event: yes
  kfunc: yes
  kprobe_multi: no
  uprobe_multi: yes
  raw_tp_special: yes
  iter: yes

[ajor]

Thanks for the report @piso77. I can't reproduce it on my kernel, so would you be able to share the output of your verifier logs to help us debug it please?

You should (hopefully) be able to get it with this command:

# bpftrace -e 'kfunc:filp_close { $f = path(args.filp->f_path); if (strcontains($f, "tmp")) { printf("OK\n"); exit(); } }' -d verifier

[piso77]

$ sudo ./src/bpftrace -v -e 'kfunc:filp_close { $f = path(args.filp->f_path); if (strcontains($f, "tmp")) { printf("OK\n"); exit(); } }' -d verifier
AST node count: 19
Attaching 1 probe...
BPF verifier log for kfunc_vmlinux_filp_close_1:
--------------------------------------
func#0 @0
Tracing programs must provide btf_id
verification time 37 usec
stack depth 0
processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0

ERROR: Error loading BPF program for kfunc_vmlinux_filp_close_1.
Kernel error log: 
func#0 @0
Tracing programs must provide btf_id
verification time 37 usec
stack depth 0
processed 0 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0


ERROR: Loading BPF object(s) failed.

[piso77]

config-6.10.0-rc7.txt

Here is the .config i've used to build the above kernel.

[viktormalik]

@piso77 based on the log, it looks to me that you don't have a sufficiently new libbpf installed. Since #3285, we require libbpf which includes libbpf/libbpf@dd589c3.