bpf_get_stack(id) failed with error code -14

[miasamnia]

Hello everyone,

I’m encountering an issue while writing an eBPF program. When I use bpf_get_stack or bpf_get_stackid, they return -14. However, on another machine with the same kernel version (4.18) but a different operating system (4.18.0-193 vs 4.18.0-348), I can successfully retrieve stack information.

Could you please help me identify whether the problem lies in my code or if it’s related to the operating system? If it’s an OS-related issue, what methods can I use to confirm this?

code:

...
struct kfree_data {
    u64 stack[16];
    long stack_len;
    long stackid;
    u32 saddr;
    u32 daddr;
    u16 sport;
    u16 dport;
	u32 state;
    u32 type;
};
...

struct bpf_map_def SEC("maps") rtp_kfree_skb_events = {
	.type        = BPF_MAP_TYPE_PERF_EVENT_ARRAY,
    .key_size    = sizeof(int),
	.value_size  = sizeof(int),
};

struct bpf_map_def SEC("maps") __kfree_skb_stack_map = {
    .type = BPF_MAP_TYPE_STACK_TRACE,
    .key_size=sizeof(u32),
    .value_size=127*sizeof(u64),
    .max_entries=128,
};


SEC("raw_tp/kfree_skb")
int rtp_kfree_skb(struct bpf_raw_tracepoint_args *ctx) {
    struct kfree_data data={};
    struct sk_buff* sb = (struct sk_buff*)ctx->args[0];
    struct sock *sk;
    u8 state;
    bpf_probe_read_kernel(&sk,sizeof(sk),&(sb->sk));
    bpf_probe_read_kernel(&state, sizeof(state), &sk->__sk_common.skc_state);
    if(state==7)return 0;//tcp_close
	data.state=state;
    bpf_probe_read_kernel(&data.saddr,sizeof(data.saddr),&(sk->__sk_common.skc_rcv_saddr));
    data.saddr = bpf_ntohl(data.saddr);
    bpf_probe_read_kernel(&data.daddr,sizeof(data.daddr),&(sk->__sk_common.skc_daddr));
    data.daddr = bpf_ntohl(data.daddr);
    bpf_probe_read_kernel(&data.dport,sizeof(data.dport),&(sk->__sk_common.skc_dport));
    data.dport = bpf_ntohs(data.dport);
    bpf_probe_read_kernel(&data.sport,sizeof(data.sport),&(sk->__sk_common.skc_num));
    data.sport = data.sport;
	if(data.saddr==0&&data.daddr==0&&data.dport==0&&data.sport==0)return 0;
    data.stack_len = bpf_get_stack(ctx,data.stack,128,4);
    if(data.stack_len<0){
        data.stackid=bpf_get_stackid(ctx, &__kfree_skb_stack_map, 4);
    }
    data.type=1;
    bpf_perf_event_output(ctx, &rtp_kfree_skb_events, BPF_F_CURRENT_CPU, &data, sizeof(data));
	return 0;
}