Below patch broke by rpm build for Fedora (based on Fedora's official srpms) for me when building bpftool:
""" link.c: In function ‘is_x86_ibt_enabled’: link.c:288:37: error: array type has incomplete element type ‘struct kernel_config_option’ 288 | struct kernel_config_option options[] = { | ^~~~~~~ [...] cc1: all warnings being treated as errors make[2]: *** [Makefile:259: /builddir/build/BUILD/kernel-6.17.8-build/kernel-6.17.8-rc1/linux-6.17.8-0.rc1.300.vanilla.fc43.x86_64/tools/testing/selftests/bpf/tools/build/bpftool/link.o] Error 1 """
Full log: https://download.copr.fedorainfracloud.org/results/@kernel-vanilla/fedora-rc...
Reverting below change fixed things for me.
Haven't tried yet, but according from a quick search on lore as well as what Sasha's AI says in https://lore.kernel.org/all/20251009155752.773732-64-sashal@kernel.org/ it might also be possible to fix this by backporting 70f32a10ad423 ("bpftool: Refactor kernel config reading into common helper")
Ciao, Thorsten
On 11/11/25 01:35, Greg Kroah-Hartman wrote:
6.17-stable review patch. If anyone has any objections, please let me know.
From: Yuan Chen chenyuan@kylinos.cn
[ Upstream commit 6417ca85305ecaffef13cf9063ac35da8fba8500 ]
Adjust symbol matching logic to account for Control-flow Enforcement Technology (CET) on x86_64 systems. CET prefixes functions with a 4-byte 'endbr' instruction, shifting the actual hook entry point to symbol + 4.
Signed-off-by: Yuan Chen chenyuan@kylinos.cn Signed-off-by: Daniel Borkmann daniel@iogearbox.net Acked-by: Quentin Monnet qmo@kernel.org Acked-by: Yonghong Song yonghong.song@linux.dev Acked-by: Jiri Olsa jolsa@kernel.org Link: https://lore.kernel.org/bpf/20250829061107.23905-3-chenyuan_fl@163.com Signed-off-by: Sasha Levin sashal@kernel.org
tools/bpf/bpftool/link.c | 54 +++++++++++++++++++++++++++++++++++++--- 1 file changed, 50 insertions(+), 4 deletions(-)
diff --git a/tools/bpf/bpftool/link.c b/tools/bpf/bpftool/link.c index a773e05d5ade4..bdcd717b0348f 100644 --- a/tools/bpf/bpftool/link.c +++ b/tools/bpf/bpftool/link.c @@ -282,11 +282,52 @@ get_addr_cookie_array(__u64 *addrs, __u64 *cookies, __u32 count) return data; } +static bool is_x86_ibt_enabled(void) +{ +#if defined(__x86_64__)
- struct kernel_config_option options[] = {
{ "CONFIG_X86_KERNEL_IBT", },- };
- char *values[ARRAY_SIZE(options)] = { };
- bool ret;
- if (read_kernel_config(options, ARRAY_SIZE(options), values, NULL))
return false;- ret = !!values[0];
- free(values[0]);
- return ret;
+#else
- return false;
+#endif +}
+static bool +symbol_matches_target(__u64 sym_addr, __u64 target_addr, bool is_ibt_enabled) +{
- if (sym_addr == target_addr)
return true;- /*
* On x86_64 architectures with CET (Control-flow Enforcement Technology),* function entry points have a 4-byte 'endbr' instruction prefix.* This causes kprobe hooks to target the address *after* 'endbr'* (symbol address + 4), preserving the CET instruction.* Here we check if the symbol address matches the hook target address* minus 4, indicating a CET-enabled function entry point.*/- if (is_ibt_enabled && sym_addr == target_addr - 4)
return true;- return false;
+}
static void show_kprobe_multi_json(struct bpf_link_info *info, json_writer_t *wtr) { struct addr_cookie *data; __u32 i, j = 0;
- bool is_ibt_enabled;
jsonw_bool_field(json_wtr, "retprobe", info->kprobe_multi.flags & BPF_F_KPROBE_MULTI_RETURN); @@ -306,11 +347,13 @@ show_kprobe_multi_json(struct bpf_link_info *info, json_writer_t *wtr) if (!dd.sym_count) goto error;
- is_ibt_enabled = is_x86_ibt_enabled(); for (i = 0; i < dd.sym_count; i++) {
if (dd.sym_mapping[i].address != data[j].addr)
if (!symbol_matches_target(dd.sym_mapping[i].address,data[j].addr, is_ibt_enabled)) continue;
jsonw_uint_field(json_wtr, "addr", dd.sym_mapping[i].address);
jsonw_uint_field(json_wtr, "addr", (unsigned long)data[j].addr);@@ -719,6 +762,7 @@ static void show_kprobe_multi_plain(struct bpf_link_info *info) { struct addr_cookie *data; __u32 i, j = 0;
- bool is_ibt_enabled;
if (!info->kprobe_multi.count) return; @@ -742,12 +786,14 @@ static void show_kprobe_multi_plain(struct bpf_link_info *info) if (!dd.sym_count) goto error;
- is_ibt_enabled = is_x86_ibt_enabled(); printf("\n\t%-16s %-16s %s", "addr", "cookie", "func [module]"); for (i = 0; i < dd.sym_count; i++) {
if (dd.sym_mapping[i].address != data[j].addr)
if (!symbol_matches_target(dd.sym_mapping[i].address,data[j].addr, is_ibt_enabled)) continue;
dd.sym_mapping[i].address, data[j].cookie, dd.sym_mapping[i].name);
(unsigned long)data[j].addr, data[j].cookie, dd.sym_mapping[i].name);