GitHub pull request #3669 of commit 2133464fe9b92be51ec80e4db7fb23ff9e77c40e, no merge conflicts.sha1origin/pr/3669/mergeghprbActualCommit2133464fe9b92be51ec80e4db7fb23ff9e77c40eghprbActualCommitAuthorghprbActualCommitAuthorEmailghprbAuthorRepoGitUrlhttps://github.com/alan-maguire/bcc.gitghprbTriggerAuthorghprbTriggerAuthorEmailghprbTriggerAuthorLoginyonghong-songghprbTriggerAuthorLoginMention@yonghong-songghprbPullId3669ghprbTargetBranchmasterghprbSourceBranchksnoop-fixGIT_BRANCHksnoop-fixghprbPullAuthorEmailghprbPullAuthorLoginalan-maguireghprbPullAuthorLoginMention@alan-maguireghprbPullDescriptionGitHub pull request #3669 of commit 2133464fe9b92be51ec80e4db7fb23ff9e77c40e, no merge conflicts.ghprbPullTitleksnoop: fix verification failures on 5.15 kernelghprbPullLinkhttps://github.com/iovisor/bcc/pull/3669ghprbPullLongDescriptionhengqi.chen@gmail.com reported:\r\n\r\nI have two VMs:\r\n\r\nOne has the kernel built against the following commit:\r\n\r\n0693b27644f04852e46f7f034e3143992b658869 (bpf-next)\r\n\r\nThe ksnoop tool (from BCC repo) works well on this VM.\r\n\r\nAnother has the kernel built against the following commit:\r\n\r\n5319255b8df9271474bc9027cabf82253934f28d (bpf-next)\r\n\r\nOn this VM, the ksnoop tool failed with the following message:\r\n\r\n[snip]\r\n\r\n; last_ip = func_stack->ips[last_stack_depth];\r\n\r\n141: (67) r6 <<= 3\r\n\r\n142: (0f) r3 += r6\r\n\r\n; ip = func_stack->ips[stack_depth];\r\n\r\n143: (79) r2 = *(u64 *)(r4 +0)\r\n\r\n frame1: R0=map_value(id=0,off=0,ks=8,vs=144,imm=0) R1_w=invP(id=4,smin_value=-1,smax_value=14) R2_w=invP(id=0,umax_value=2040,var_off=(0x0; 0x7f8)) R3_w=map_value(id=0,off=8,ks=8,vs=144,umax_value=120,var_off=(0x0; 0x78)) R4_w=map_value(id=0,off=8,ks=8,vs=144,umax_value=2040,var_off=(0x0; 0x7f8)) R6_w=invP(id=0,umax_value=120,var_off=(0x0; 0x78)) R7=map_value(id=0,off=0,ks=8,vs=144,imm=0) R9=ctx(id=0,off=0,imm=0) R10=fp0 fp-16=mmmmmmmm fp-24=mmmmmmmm fp-32=mmmmmmmm fp-40=mmmmmmmm fp-48=mmmmmmmm fp-56=mmmmmmmm fp-64=mmmmmmmm fp-72=mmmmmmmm fp-80=mmmmmmmm fp-88=mmmmmmmm fp-96=mmmmmmmm fp-104=mmmmmmmm fp-112=mmmmmmmm fp-120=mmmmmmmm fp-128=mmmmmmmm fp-136=mmmmmmmm fp-144=mmmmmmmm fp-152=mmmmmmmm fp-160=mmmmmmmm fp-168=00000000\r\n\r\ninvalid access to map value, value_size=144 off=2048 size=8\r\n\r\nR4 max value is outside of the allowed memory range\r\n\r\nprocessed 65 insns (limit 1000000) max_states_per_insn 0 total_states 3 peak_states 3 mark_read 2\r\n\r\nlibbpf: -- END LOG --\r\n\r\nlibbpf: failed to load program 'kprobe_return'\r\n\r\nlibbpf: failed to load object 'ksnoop_bpf'\r\n\r\nlibbpf: failed to load BPF skeleton 'ksnoop_bpf': -4007\r\n\r\nError: Could not load ksnoop BPF: Unknown error 4007\r\n\r\nThe above invalid map access appears to stem from the fact the\r\n\"stack_depth\" variable (used to retrieve the instruction pointer\r\nfrom the recorded call stack) is decremented. The off=2048\r\nvalue is a clue; this suggests an index resulting from an underflow\r\nof the __u8 index value. Adding a bitmask to the decrement operation\r\nsolves the problem. It appears that the guards on stack_depth size\r\naround the array dereference were optimized out.\r\n\r\nReported-by: Hengqi Chen <hengqi.chen@gmail.com>\r\nSigned-off-by: Alan Maguire <alan.maguire@oracle.com>ghprbCommentBody[buildbot, test this please]ghprbGhRepositoryiovisor/bccghprbCredentialsId6d3daf13-69b8-48b1-9c8f-ec5353264113false<a title="ksnoop: fix verification failures on 5.15 kernel" href="https://github.com/iovisor/bcc/pull/3669">PR #3669</a>: ksnoop: fix verification fa...#119213342747460664bcc-pr #11921192false11929545SUCCESS1634653890530https://buildbot.iovisor.org/jenkins/job/bcc-pr/1192/git1192https://buildbot.iovisor.org/jenkins/job/bcc-pr/label=fc25/1192/1192https://buildbot.iovisor.org/jenkins/job/bcc-pr/label=fc26/1192/1192https://buildbot.iovisor.org/jenkins/job/bcc-pr/label=fc27/1192/1192https://buildbot.iovisor.org/jenkins/job/bcc-pr/label=fc28/1192/1192https://buildbot.iovisor.org/jenkins/job/bcc-pr/label=ubuntu1604/1192/1192https://buildbot.iovisor.org/jenkins/job/bcc-pr/label=ubuntu1710/1192/1192https://buildbot.iovisor.org/jenkins/job/bcc-pr/label=ubuntu1804/1192/