Bug 2088577

Summary:	execsnoop.bt fails: ERROR: Error loading program: tracepoint:syscalls:sys_enter_execve (try -v)
Product:	Red Hat Enterprise Linux 9	Reporter:	Jerome Marchand <jmarchan>
Component:	bpftrace	Assignee:	Viktor Malik <vmalik>
Status:	CLOSED ERRATA	QA Contact:	Ziqian SUN (Zamir) <zsun>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	9.0	CC:	jmarchan, rdossant, shichen, vmalik, zsun
Target Milestone:	rc	Keywords:	Triaged
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	bpftrace-0.16.0-1.el9	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	2095304 (view as bug list)		Environment:
Last Closed:	2023-05-09 07:47:49 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2121920
Bug Blocks:	2095304

Description Jerome Marchand 2022-05-19 17:51:23 UTC

Description of problem:
Since the rebuild with llvm 14, the join() function of bcc is broken. The most user visible effect of this is the failure of the execsnoop tool.

Version-Release number of selected component (if applicable):


How reproducible:

Steps to Reproduce:
1. Run execsnoop
$ /usr/share/bpftrace/tools/execsnoop.bt


Actual results:
$ /usr/share/bpftrace/tools/execsnoop.bt
Attaching 3 probes...
ERROR: Error loading program: tracepoint:syscalls:sys_enter_execve (try -v)

Expected results:
Execsnoop working and in general join() working.

Additional info:
Upstream issue:
https://github.com/iovisor/bpftrace/issues/2222

Comment 3 Viktor Malik 2022-07-13 13:38:36 UTC

Join has been fixed upstream by:

    15624fe2 Fix invalid LLVM IR in join builtin

Comment 4 Viktor Malik 2022-09-02 07:03:37 UTC

This should be fixed by the next bpftrace update.

Comment 15 errata-xmlrpc 2023-05-09 07:47:49 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (bpftrace bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:2346