libbpf-starter-template 创建 bpf prog 构建失败

[Ghostbaby]

现象

eBPF prog 代码：

#define TASK_COMM_LEN 16

// 该 prog 用于拦截 do_unlinkat 系统调用，当删除文件时，打印文件名和进程名
SEC("kprobe/do_unlinkat")
int BPF_KPROBE(do_unlinkat, int dfd, struct filename *name)
{
    const char *filename;
    __u64 pid_tgid = bpf_get_current_pid_tgid();
    __u32 pid = (pid_tgid << 32) >> 32;
    __u32 tgid = pid_tgid >> 32;
    char comm[TASK_COMM_LEN];
    long ret;

    filename = BPF_CORE_READ(name, name);

    ret = bpf_get_current_comm(&comm, TASK_COMM_LEN);
    if(ret)
    {
        bpf_printk("Failed to get current task name, pid = %d\n", pid);
        return 1;
    }
    bpf_printk("KPROBE ENTRY pid = %d, filename = %s\n", pid, filename);
    return 8;
}  

构建报错：

# cd src
# make
  BPF      .output/bootstrap.bpf.o
bootstrap.bpf.c:116:16: error: A call to built-in function '__stack_chk_fail' is not supported.
int BPF_KPROBE(do_unlinkat, int dfd, struct filename *name)
               ^
1 error generated.

复现

1. 使用模版创建 bpf 项目，参考文档：https://github.com/eunomia-bpf/bpf-developer-tutorial/blob/main/README.zh.md
2. 将上述 eBPF prog 代码增加到 src/bootstrap.bpf.c 文件中。
3. 进入 src 目录执行 make，复现上述构建失败现象。

[Ghostbaby]

方案

1. 移除 /src/Makefile#L86 的 -fstack-protector clang 构建标签
2. 使用 Per-CPU 数组

struct {
    __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
    __uint(max_entries, 1);
    __type(key, u32);
    __type(value, char[TASK_COMM_LEN]);
} comm_buf SEC(".maps");

// 该 prog 用于拦截 do_unlinkat 系统调用，当删除文件时，打印文件名和进程名
SEC("kprobe/do_unlinkat")
int BPF_KPROBE(do_unlinkat, int dfd, struct filename *name)
{
    const char *filename;
    __u64 pid_tgid = bpf_get_current_pid_tgid();
    __u32 pid = (pid_tgid << 32) >> 32;
    __u32 tgid = pid_tgid >> 32;
    long ret;

	u32 key = 0;
    char *comm = bpf_map_lookup_elem(&comm_buf, &key);
    if (!comm)
        return 0;

    filename = BPF_CORE_READ(name, name);

    bpf_get_current_comm(comm, TASK_COMM_LEN);
    bpf_printk("KPROBE ENTRY pid = %d, filename = %s\n", pid, filename);
    return 8;
}  

[Ghostbaby]

为什么只有 bpf_get_current_comm 会触发 __stack_chk_fail 的原因是：

bpf_get_current_comm 的第一个参数是一个定长数组（如 char comm[16]），而且它不是简单的局部变量赋值，而是一个 helper 函数会把数据写入这个数组。
编译器分析到这个数组有可能被“溢出写入”，就会自动为该函数插入栈保护代码（stack canary），即 __stack_chk_guard 和 __stack_chk_fail。

而像 int、long、指针等简单类型的局部变量，或者没有大数组的函数，编译器不会插入栈保护代码。

总结

只要函数里有类似 char comm[16]; 并传给 bpf_get_current_comm 这种 helper，clang/bpf target 就会认为有溢出风险，插入栈保护代码。
这就是为什么只有用 bpf_get_current_comm（或类似需要写入局部数组的 helper）时会遇到 __stack_chk_fail not supported 的报错。

[Ghostbaby]

排查过程

确定 clang -fstack-protector 在 target 为 x86-64 时候的逻辑

测试代码：

// force_ssp.c
#include <string.h>

void __attribute__((noinline)) vulnerable_func(const char *input) {
    char buffer[8];  // 小缓冲区
    strcpy(buffer, input);  // 明显的缓冲区溢出风险
}

void test_overflow() {
    vulnerable_func("this is a long string that will overflow");
}

构建命令：
clang -O0 -fstack-protector-all -c force_ssp.c -o force_ssp.o

查看反编译信息：

# objdump -d force_ssp.o

force_ssp.o:     file format elf64-x86-64


Disassembly of section .text:

0000000000000000 <vulnerable_func>:
   0:   55                      push   %rbp
   1:   48 89 e5                mov    %rsp,%rbp
   4:   48 83 ec 20             sub    $0x20,%rsp
   8:   64 48 8b 04 25 28 00    mov    %fs:0x28,%rax
   f:   00 00 
  11:   48 89 45 f8             mov    %rax,-0x8(%rbp)
  15:   48 89 7d e8             mov    %rdi,-0x18(%rbp)
  19:   48 8b 75 e8             mov    -0x18(%rbp),%rsi
  1d:   48 8d 7d f0             lea    -0x10(%rbp),%rdi
  21:   e8 00 00 00 00          call   26 <vulnerable_func+0x26>
  26:   64 48 8b 04 25 28 00    mov    %fs:0x28,%rax
  2d:   00 00 
  2f:   48 8b 4d f8             mov    -0x8(%rbp),%rcx
  33:   48 39 c8                cmp    %rcx,%rax
  36:   0f 85 06 00 00 00       jne    42 <vulnerable_func+0x42>
  3c:   48 83 c4 20             add    $0x20,%rsp
  40:   5d                      pop    %rbp
  41:   c3                      ret    
  42:   e8 00 00 00 00          call   47 <vulnerable_func+0x47>
  47:   66 0f 1f 84 00 00 00    nopw   0x0(%rax,%rax,1)
  4e:   00 00 

0000000000000050 <test_overflow>:
  50:   55                      push   %rbp
  51:   48 89 e5                mov    %rsp,%rbp
  54:   48 83 ec 10             sub    $0x10,%rsp
  58:   64 48 8b 04 25 28 00    mov    %fs:0x28,%rax
  5f:   00 00 
  61:   48 89 45 f8             mov    %rax,-0x8(%rbp)
  65:   48 8d 3d 00 00 00 00    lea    0x0(%rip),%rdi        # 6c <test_overflow+0x1c>
  6c:   e8 00 00 00 00          call   71 <test_overflow+0x21>
  71:   64 48 8b 04 25 28 00    mov    %fs:0x28,%rax
  78:   00 00 
  7a:   48 8b 4d f8             mov    -0x8(%rbp),%rcx
  7e:   48 39 c8                cmp    %rcx,%rax
  81:   0f 85 06 00 00 00       jne    8d <test_overflow+0x3d>
  87:   48 83 c4 10             add    $0x10,%rsp
  8b:   5d                      pop    %rbp
  8c:   c3                      ret    
  8d:   e8 00 00 00 00          call   92 <test_overflow+0x42>

查看重定向信息：

# objdump -r force_ssp.o

force_ssp.o:     file format elf64-x86-64

RELOCATION RECORDS FOR [.text]:
OFFSET           TYPE              VALUE 
0000000000000022 R_X86_64_PLT32    strcpy-0x0000000000000004
0000000000000043 R_X86_64_PLT32    __stack_chk_fail-0x0000000000000004
0000000000000068 R_X86_64_PC32     .L.str-0x0000000000000004
000000000000006d R_X86_64_PLT32    vulnerable_func-0x0000000000000004
000000000000008e R_X86_64_PLT32    __stack_chk_fail-0x0000000000000004


RELOCATION RECORDS FOR [.eh_frame]:
OFFSET           TYPE              VALUE 
0000000000000020 R_X86_64_PC32     .text
0000000000000044 R_X86_64_PC32     .text+0x0000000000000050

查看符号信息：

# nm force_ssp.o
0000000000000000 r .L.str
                 U __stack_chk_fail
                 U strcpy
0000000000000050 T test_overflow
0000000000000000 T vulnerable_func

在 x86-64 目标上，栈保护确实被插入了：

• mov %fs:0x28,%rax - 读取 canary 值
• mov %rax,-0x8(%rbp) - 保存到栈上
• 函数结束时检查 canary
• call 指令在 offset 0x42 和 0x8d - 这就是对 __stack_chk_fail 的调用

[Ghostbaby]

确定 bpf target 逻辑

测试代码：

// bpf_force_ssp.c
#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>

SEC("kprobe/test")
int force_ssp(void *ctx) {
    char buffer[8];
    // 模拟 strcpy 行为
    buffer[0] = 't';
    buffer[1] = 'h';
    buffer[2] = 'i';
    buffer[3] = 's';
    buffer[4] = ' ';
    buffer[5] = 'i';
    buffer[6] = 's';
    buffer[7] = ' ';
    buffer[8] = 'l';  // 越界访问！
    buffer[9] = 'o';
    buffer[10] = 'n';
    buffer[11] = 'g';
    
    return buffer[0];
}

char _license[] SEC("license") = "GPL";

编译命令：

// 使用栈保护
# clang -g -fstack-protector -O0 -target bpf -D__TARGET_ARCH_x86 -I.output -I../libbpf/include/uapi -I../vmlinux/x86/ -idirafter /usr/lib/llvm-14/lib/clang/14.0.0/include -idirafter /usr/local/include -idirafter /usr/include/x86_64-linux-gnu -idirafter /usr/include -c bpf_force_ssp.c -o bpf_ssp.o

// 禁用栈保护
# clang -g -fno-stack-protector -O0 -target bpf -D__TARGET_ARCH_x86 -I.output -I../libbpf/include/uapi -I../vmlinux/x86/ -idirafter /usr/lib/llvm-14/lib/clang/14.0.0/include -idirafter /usr/local/include -idirafter /usr/include/x86_64-linux-gnu -idirafter /usr/include -c bpf_force_ssp.c -o bpf_nossp.o

查看重定向信息：

oot@codespaces-ade1e1:/workspaces/libbpf-starter-template/src# llvm-objdump -r bpf_nossp.o

bpf_nossp.o:    file format elf64-bpf

RELOCATION RECORDS FOR [.debug_info]:
OFFSET           TYPE                     VALUE
0000000000000008 R_BPF_64_ABS32           .debug_abbrev
0000000000000011 R_BPF_64_ABS32           .debug_str_offsets
0000000000000015 R_BPF_64_ABS32           .debug_line
000000000000001f R_BPF_64_ABS32           .debug_addr

RELOCATION RECORDS FOR [.debug_str_offsets]:
OFFSET           TYPE                     VALUE
0000000000000008 R_BPF_64_ABS32           .debug_str
000000000000000c R_BPF_64_ABS32           .debug_str
0000000000000010 R_BPF_64_ABS32           .debug_str
0000000000000014 R_BPF_64_ABS32           .debug_str
0000000000000018 R_BPF_64_ABS32           .debug_str
000000000000001c R_BPF_64_ABS32           .debug_str
0000000000000020 R_BPF_64_ABS32           .debug_str
0000000000000024 R_BPF_64_ABS32           .debug_str
0000000000000028 R_BPF_64_ABS32           .debug_str
000000000000002c R_BPF_64_ABS32           .debug_str

RELOCATION RECORDS FOR [.debug_addr]:
OFFSET           TYPE                     VALUE
0000000000000008 R_BPF_64_ABS64           _license
0000000000000010 R_BPF_64_ABS64           kprobe/test

RELOCATION RECORDS FOR [.BTF]:
OFFSET           TYPE                     VALUE
00000000000000ac R_BPF_64_NODYLD32        _license

RELOCATION RECORDS FOR [.BTF.ext]:
OFFSET           TYPE                     VALUE
000000000000002c R_BPF_64_NODYLD32        kprobe/test
0000000000000040 R_BPF_64_NODYLD32        kprobe/test
0000000000000050 R_BPF_64_NODYLD32        kprobe/test
0000000000000060 R_BPF_64_NODYLD32        kprobe/test
0000000000000070 R_BPF_64_NODYLD32        kprobe/test
0000000000000080 R_BPF_64_NODYLD32        kprobe/test
0000000000000090 R_BPF_64_NODYLD32        kprobe/test
00000000000000a0 R_BPF_64_NODYLD32        kprobe/test
00000000000000b0 R_BPF_64_NODYLD32        kprobe/test
00000000000000c0 R_BPF_64_NODYLD32        kprobe/test
00000000000000d0 R_BPF_64_NODYLD32        kprobe/test
00000000000000e0 R_BPF_64_NODYLD32        kprobe/test
00000000000000f0 R_BPF_64_NODYLD32        kprobe/test
0000000000000100 R_BPF_64_NODYLD32        kprobe/test
0000000000000110 R_BPF_64_NODYLD32        kprobe/test
0000000000000120 R_BPF_64_NODYLD32        kprobe/test

RELOCATION RECORDS FOR [.debug_frame]:
OFFSET           TYPE                     VALUE
0000000000000014 R_BPF_64_ABS32           .debug_frame
0000000000000018 R_BPF_64_ABS64           kprobe/test

RELOCATION RECORDS FOR [.debug_line]:
OFFSET           TYPE                     VALUE
0000000000000022 R_BPF_64_ABS32           .debug_line_str
000000000000002e R_BPF_64_ABS32           .debug_line_str
0000000000000048 R_BPF_64_ABS64           kprobe/test

root@codespaces-ade1e1:/workspaces/libbpf-starter-template/src# llvm-objdump -r bpf_ssp.o

bpf_ssp.o:      file format elf64-bpf

RELOCATION RECORDS FOR [kprobe/test]:
OFFSET           TYPE                     VALUE
0000000000000008 R_BPF_64_64              __stack_chk_guard
0000000000000128 R_BPF_64_32              __stack_chk_fail

RELOCATION RECORDS FOR [.debug_info]:
OFFSET           TYPE                     VALUE
0000000000000008 R_BPF_64_ABS32           .debug_abbrev
0000000000000011 R_BPF_64_ABS32           .debug_str_offsets
0000000000000015 R_BPF_64_ABS32           .debug_line
000000000000001f R_BPF_64_ABS32           .debug_addr

RELOCATION RECORDS FOR [.debug_str_offsets]:
OFFSET           TYPE                     VALUE
0000000000000008 R_BPF_64_ABS32           .debug_str
000000000000000c R_BPF_64_ABS32           .debug_str
0000000000000010 R_BPF_64_ABS32           .debug_str
0000000000000014 R_BPF_64_ABS32           .debug_str
0000000000000018 R_BPF_64_ABS32           .debug_str
000000000000001c R_BPF_64_ABS32           .debug_str
0000000000000020 R_BPF_64_ABS32           .debug_str
0000000000000024 R_BPF_64_ABS32           .debug_str
0000000000000028 R_BPF_64_ABS32           .debug_str
000000000000002c R_BPF_64_ABS32           .debug_str

RELOCATION RECORDS FOR [.debug_addr]:
OFFSET           TYPE                     VALUE
0000000000000008 R_BPF_64_ABS64           _license
0000000000000010 R_BPF_64_ABS64           kprobe/test

RELOCATION RECORDS FOR [.BTF]:
OFFSET           TYPE                     VALUE
00000000000000ac R_BPF_64_NODYLD32        _license

RELOCATION RECORDS FOR [.BTF.ext]:
OFFSET           TYPE                     VALUE
000000000000002c R_BPF_64_NODYLD32        kprobe/test
0000000000000040 R_BPF_64_NODYLD32        kprobe/test
0000000000000050 R_BPF_64_NODYLD32        kprobe/test
0000000000000060 R_BPF_64_NODYLD32        kprobe/test
0000000000000070 R_BPF_64_NODYLD32        kprobe/test
0000000000000080 R_BPF_64_NODYLD32        kprobe/test
0000000000000090 R_BPF_64_NODYLD32        kprobe/test
00000000000000a0 R_BPF_64_NODYLD32        kprobe/test
00000000000000b0 R_BPF_64_NODYLD32        kprobe/test
00000000000000c0 R_BPF_64_NODYLD32        kprobe/test
00000000000000d0 R_BPF_64_NODYLD32        kprobe/test
00000000000000e0 R_BPF_64_NODYLD32        kprobe/test
00000000000000f0 R_BPF_64_NODYLD32        kprobe/test
0000000000000100 R_BPF_64_NODYLD32        kprobe/test
0000000000000110 R_BPF_64_NODYLD32        kprobe/test
0000000000000120 R_BPF_64_NODYLD32        kprobe/test
0000000000000130 R_BPF_64_NODYLD32        kprobe/test

RELOCATION RECORDS FOR [.debug_frame]:
OFFSET           TYPE                     VALUE
0000000000000014 R_BPF_64_ABS32           .debug_frame
0000000000000018 R_BPF_64_ABS64           kprobe/test

RELOCATION RECORDS FOR [.debug_line]:
OFFSET           TYPE                     VALUE
0000000000000022 R_BPF_64_ABS32           .debug_line_str
000000000000002e R_BPF_64_ABS32           .debug_line_str
0000000000000048 R_BPF_64_ABS64           kprobe/test