clang 12 fails to build modern BPF probe with BPF stack limit error on kernel 5.8

[Ravindu-Priyankara]

Describe the bug

The modern BPF probe fails to build when using clang 12 on kernel 5.8.

The project documentation states that clang >= 12 is required for building the modern eBPF probe, but with clang 12 the build fails with a BPF stack limit exceeded error.

The same source tree builds successfully with newer clang versions (clang 13 and clang 15) on the same kernel.

How to reproduce it

Checkout:

e99567b

Build:

mkdir build
cd build

cmake ..
-DUSE_BUNDLED_DEPS=ON
-DUSE_BUNDLED_DRIVER=ON
-DBUILD_LIBSCAP_MODERN_BPF=ON
-DCREATE_TEST_TARGETS=OFF
-DENABLE_DRIVERS_TESTS=OFF

cmake --build . --target EventsDimensions ProbeSkeleton

The build fails while compiling:

driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/sendmsg.bpf.c

with:

Looks like the BPF stack limit of 512 bytes is exceeded.

Expected behaviour

The modern BPF probe should compile successfully with clang >= 12 as documented.

Screenshots

Environment

• Falco version:

e99567b

• System info:
• x86_64

• Cloud provider or hardware configuration:
• N/A
• OS:
• Ubuntu 20.10
• Fedora 33

• Kernel:
• 5.8

• Installation method:
• Source build

Additional context

clang 12:
fails

clang 13:
works

clang 15:
works

clang 12 version tested:

Ubuntu clang version 12.0.1-++20211029101333+fed41342a82f-1exp120211029221833.4
Target: x86_64-pc-linux-gnu