Inconsistent `/tmp/kheaders` directory makes bcc fail

[ncfavier]

I just spent way too long debugging why execsnoop failed with this error:

<built-in>:1:10: fatal error: './include/linux/kconfig.h' file not found
#include "./include/linux/kconfig.h"
         ^~~~~~~~~~~~~~~~~~~~~~~~~~~
1 error generated.
Traceback (most recent call last):
  File "/nix/store/7dgdpsd8lrclqzl4s5vmlm8hwm0y91d2-bcc-0.24.0/share/bcc/tools/.execsnoop-wrapped", line 228, in <module>
    b = BPF(text=bpf_text)
  File "/nix/store/7dgdpsd8lrclqzl4s5vmlm8hwm0y91d2-bcc-0.24.0/lib/python3.10/site-packages/bcc/__init__.py", line 475, in __init__
    raise Exception("Failed to compile BPF module %s" % (src_file or "<text>"))
Exception: Failed to compile BPF module <text>

The reason was that I had a directory /tmp/kheaders-5.18.15 containing nothing but an empty include/uapi directory. I have no idea how this happened. rm -r /tmp/kheaders-5.18.15 fixed it.

A few ideas on what needs to be done:

• make sure the kheaders directory is always in a consistent state when the program exits
• improve the existence check, à la https://github.com/iovisor/bcc/pull/3588

I'm on Linux 5.18.15, NixOS unstable, BCC 0.24.0.

[srikanth007m]

@ncfavier I am also facing similar issue. But issue still persists, even after removing /tmp/kheaders folder.

<built-in>:1:10: fatal error: './include/linux/kconfig.h' file not found #include "./include/linux/kconfig.h" ^~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 error generated. Traceback (most recent call last): File "/usr/share/bcc/tools/memleak", line 445, in <module> bpf = BPF(text=bpf_source) File "/usr/lib/python3/dist-packages/bcc/__init__.py", line 479, in __init__ raise Exception("Failed to compile BPF module %s" % (src_file or "<text>")) Exception: Failed to compile BPF module <text>

[charles-typ]

I encountered the same error on CentOS 9, version 6.13.7-1.el9.elrepo.aarch64, with the latest bcc-tools.

Removing /tmp/kheaders* resolved the issue.

I'm unsure why /tmp/kheaders* exists in the first place. I was able to perform offcpu profiling successfully just a week ago, but when I tried running it again today, this problem suddenly appeared

[Lekensteyn]

Ran into this issue as well. I suspect that systemd's tmpfiles configuration of 10 days ends up clearing the kheaders directory on some systems.

Workaround is to remove /tmp/kheaders-$(uname -r). If the problem persists, you might have a broken kernel headers package like #4503.

Proposed fix: #5395