elastic / ebpf

Elastic's eBPF
Other
62 stars 11 forks source link

`fexit/inet_csk_accept` probe will not work on kernel >=6.10 #200

Closed fearful-symmetry closed 3 weeks ago

fearful-symmetry commented 3 weeks ago

Severity

Major

Affects Version(s)

8.6.0

Epic/Meta Issue

No response

Kernel Version(s)

6.10.3-200

Linux Distro

Fedora 30

Fix Versions

No response

Description

A commit 5 months ago changed the function signature of inet_csk_accept: https://github.com/torvalds/linux/commit/92ef0fd55ac80dfc2e4654edfe5d1ddfa6e070fe

On the kernel on my dev machine, it looks like this: struct sock *inet_csk_accept(struct sock *sk, struct proto_accept_arg *arg)

The code is not currently prepared for this possibility:

sudo ./EventsTrace                                                                                                                                                  1 ↵
libbpf: prog 'fexit__inet_csk_accept': BPF program load failed: Permission denied
libbpf: prog 'fexit__inet_csk_accept': -- BEGIN PROG LOAD LOG --
0: R1=ctx() R10=fp0
; int BPF_PROG( @ Probe.bpf.c:45
0: (79) r6 = *(u64 *)(r1 +32)
func 'inet_csk_accept' doesn't have 4-th argument
invalid bpf_context access off=32 size=8
processed 1 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0
-- END PROG LOAD LOG --
libbpf: prog 'fexit__inet_csk_accept': failed to load: -13
libbpf: failed to load object 'EventProbe_bpf'
libbpf: failed to load BPF skeleton 'EventProbe_bpf': -13
Could not create event context: -13 Permission denied