bpftool incorrectly shows helper support for bpf_getsockopt

[kuroa-me]

Output:

# bpftool feature probe | grep sockopt
eBPF program_type cgroup_sockopt is available
	- bpf_setsockopt
	- bpf_getsockopt
	- bpf_setsockopt
	- bpf_getsockopt
eBPF helpers supported for program type cgroup_sockopt:
	- bpf_setsockopt
	- bpf_getsockopt

Expected output:

# bpftool feature probe | grep sockopt
eBPF program_type cgroup_sockopt is available
	- bpf_setsockopt
	- bpf_getsockopt
eBPF helpers supported for program type cgroup_sockopt:

Version:

# bpftool --version
bpftool v5.10.140

Kernel Version:

# uname -r
5.10.0-14-amd64

The helper bpf_getsockopt did not get merged into kernel until 5.12 due to my research. Cilium is using bpftool to check whether this helper exist. On kernel 5.10, bpftool show this helper exist, so cilium tries to use this helper and crashed because it does not exist. I tried bpftool on kernel 5.4.214, it correctly show the absence of the helper.

[kuroa-me]

Sorry, seems like this issue needs to be sent to the email and not posted here... My apologies.

[qmonnet]

Patches for bpftool should be sent to the mailing list. I don't mind too much if issues are opened here, although reports will have more visibility on the mailing list. Thanks for the report :)

Did you try with the latest version of bpftool to see if the issue is still present? Can you also tell for what program types the helpers were incorrectly detected? (It's not possible to tell from your filtered output).

I get the following on 5.4

$ bpftool --version                                    
/usr/lib/linux-tools/5.4.0-126-generic/bpftool v5.4.203

# bpftool -j feature probe | gron | grep 'bpf.*sockopt' 
json.helpers.sock_ops_available_helpers[11] = "bpf_setsockopt";
json.helpers.sock_ops_available_helpers[13] = "bpf_getsockopt";

And the following on 5.18, with latest bpftool from bpf-next:

$ bpftool version
bpftool v7.1.0
using libbpf v1.1
features: libbfd, libbpf_strict, skeletons

# bpftool -j feature probe | gron | grep 'bpf.*sockopt'    
json.helpers.cgroup_sock_addr_available_helpers[15] = "bpf_setsockopt";
json.helpers.cgroup_sock_addr_available_helpers[16] = "bpf_getsockopt";
json.helpers.sock_ops_available_helpers[11] = "bpf_setsockopt";
json.helpers.sock_ops_available_helpers[13] = "bpf_getsockopt"

Overall, the probes have changed somewhat after they were reworked in libbpf some time ago (not sure when, but after 5.10 so I wouldn't be surprised if the issue has been fixed).

Also, if this caused an issue with Cilium, did you report an issue on the Cilium repository? (Even though we're moving away from bpftool for probing features, but would still be good to track this).