btf: CO-RE against kernel module fails with invalid relocation about ebpf

[lmb]

For some reason your program is causing our CO-RE code to bail out. 195896080 is 0xbad2310 in hex, which is

ebpf/btf/core.go

Line 44 in 4927ec8

const badRelo = 0xbad2310

So most likely the cause is that there is a slight mismatch between libbpf and our rules around type eqality for CO-RE.

Can you please upload the compiled BPF .o? Compiling it on my machine doesn't work out of the box.

[bitness]

Certainly, here are the compiled object files. I'm including the ones from the go build as well as the one I built for the libbpf program, which was compiled with this command:

clang -g -O2 -target bpf -march=probe -D__TARGET_ARCH_x86 -Ix86/ -c rmdir-watch.bpf.c -o rmdir-watch.bpf.o

I'm doing the build on an AlmaLinux 9.1 machine with the clang-14.0.6-4.el9_1.x86_64 RPM. Here's its version output:

clang version 14.0.6 (Red Hat 14.0.6-4.el9_1)
Target: x86_64-redhat-linux-gnu
Thread model: posix
InstalledDir: /bin

The libbpf RPM is libbpf-0.6.0-1.el9.x86_64. Its source rpm is here if that's helpful.

container-of-repro-object-files.zip

[bitness]

Also, if it helps--even with libbpf, I've found that I have to use bpf_core_read and friends to access data through pointers I get out of container_of usage. I think the pointer math it does is weird enough to confuse libbpf's automatic access conversions.

[lmb]

So, the problem is that struct nfs_inode is not part of vmlinux BTF, instead it is part of module nfs. Our current CO-RE code is oblivious to kernel modules, and so can't find nfs_inode. We don't bail out with an error, since it's valid to reference non-existent types when their use is guarded by if core_type_exists(...).

So, unfortunately, you've run into the last remaining point of #705. I'm also unhappy that the error message is so obtuse, unfortunately the error is output by the kernel. Maybe there is a way to improve that.

[bitness]

Thanks for tracking this down! I subscribed to #705 and will try again once it's resolved.

[lmb]

This should be doable now.