linux-kernel - Re: BTF loading failing on perf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAEf4BzaedhaWKJdfkj=UPA+fBq_8h9Z=_tN4FK=jvdHzeQ3NYA@mail.gmail.com>
Date: Tue, 10 Jun 2025 16:12:04 -0700
From: Andrii Nakryiko <andrii.nakryiko@...il.com>
To: Arnaldo Carvalho de Melo <acme@...nel.org>
Cc: Leo Yan <leo.yan@....com>, Lorenz Bauer <lmb@...valent.com>, 
	Andrii Nakryiko <andrii@...nel.org>, Alan Maguire <alan.maguire@...cle.com>, 
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>, bpf@...r.kernel.org, 
	linux-perf-users@...r.kernel.org
Subject: Re: BTF loading failing on perf

On Tue, Jun 10, 2025 at 1:27 PM Arnaldo Carvalho de Melo
<acme@...nel.org> wrote:
>
> On Fri, Jun 06, 2025 at 05:05:35PM -0300, Arnaldo Carvalho de Melo wrote:
> > On Fri, Jun 06, 2025 at 09:20:57AM -0700, Andrii Nakryiko wrote:
> > > On Fri, Jun 6, 2025 at 9:14 AM Leo Yan <leo.yan@....com> wrote:
> > > > On Fri, Jun 06, 2025 at 12:37:55PM -0300, Arnaldo Carvalho de Melo wrote:
> > > > > root@...ber:~# perf trace -e openat --max-events=1
> > > > > libbpf: failed to read kernel BTF from '/sys/kernel/btf/vmlinux': -ENODEV
> > > > > libbpf: failed to read kernel BTF from '/sys/kernel/btf/vmlinux': -ENODEV
> > > > >      0.000 ( 0.016 ms): ptyxis-agent/4375 openat(dfd: CWD, filename: "/proc/6593/cmdline", flags: RDONLY|CLOEXEC) = 13
> > > > > root@...ber:~#
> > > > >
> > > > > openat(AT_FDCWD, "/sys/kernel/btf/vmlinux", O_RDONLY) = 258
> > > > > mmap(NULL, 6519699, PROT_READ, MAP_PRIVATE, 258, 0) = -1 ENODEV (No such device)
> > > > > libbpf: failed to read kernel BTF from '/sys/kernel/btf/vmlinux': -ENODEV
> > > >
> > > > Have you included the commit below in the kernel side?
> > >
> > > It doesn't matter, libbpf should silently fallback to non-mmap() way,
> >
> > Right, it has to work with older kernels, etc.
> >
> > > and it clearly doesn't.
> >
> > > We need something like this:
> > > +++ b/tools/lib/bpf/btf.c
> > > @@ -1384,12 +1384,12 @@ static struct btf *btf_parse_raw_mmap(const
> > > char *path, struct btf *base_btf)
> > >
> > >         fd = open(path, O_RDONLY);
> > >         if (fd < 0)
> > > -               return libbpf_err_ptr(-errno);
> > > +               return ERR_PTR(-errno);
> > >
> > >         if (fstat(fd, &st) < 0) {
> > >                 err = -errno;
> > >                 close(fd);
> > > -               return libbpf_err_ptr(err);
> > > +               return ERR_PTR(err);
> > >         }
> > >
> > >         data = mmap(NULL, st.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
> > > @@ -1397,7 +1397,7 @@ static struct btf *btf_parse_raw_mmap(const char
> > > *path, struct btf *base_btf)
> > >         close(fd);
> > >
> > >         if (data == MAP_FAILED)
> > > -               return libbpf_err_ptr(err);
> > > +               return ERR_PTR(err);
> > >
> > >         btf = btf_new(data, st.st_size, base_btf, true);
> > >         if (IS_ERR(btf))
> > >
> > > libbpf_err_ptr() should be used for user-facing API functions, they
> > > return NULL on error and set errno, so checking for IS_ERR() is wrong
> > > here.
> >
> > And the only user of the above function is:
> >
> >                 btf = btf_parse_raw_mmap(sysfs_btf_path, NULL);
> >                 if (IS_ERR(btf))
> >                         btf = btf__parse(sysfs_btf_path, NULL);
> >
> > That expects ERR_PTR() to then use IS_ERR().
> >
> > I think this could be automated with something like coccinnele(sp)?
>
> > Anyway, I tested the patch above and it seems to fix the issue, so:
>
> > Reported-by: Arnaldo Carvalho de Melo <acme@...hat.com>
> > Reviewed-by: Arnaldo Carvalho de Melo <acme@...hat.com>
> > Tested-by: Arnaldo Carvalho de Melo <acme@...hat.com>
>
> Was this fixed/merged?

yes, this was applied to bpf tree (not bpf-next)

>
> - Arnaldo