[SRU] sysdig-dkms 0.27.1-0.3ubuntu0.2: sysdig kernel module failed to build

[Rob Parker]

[ Impact ]

sysdig fails to install if the user is using the hwe kernel which is v6.5 as the dkms module will fail to build during installation.
The error being:

/var/lib/dkms/sysdig/0.27.1/build/main.c: In function ‘sysdig_init’:
./include/linux/export.h:29:22: error: passing argument 1 of ‘class_create’ from incompatible pointer type [-Werror=incompatible-pointer-types]
   29 | #define THIS_MODULE (&__this_module)
      | ~^~~~~~~~~~~~~~~
      | |
      | struct module *
/var/lib/dkms/sysdig/0.27.1/build/main.c:2484:36: note: in expansion of macro ‘THIS_MODULE’
 2484 | g_ppm_class = class_create(THIS_MODULE, PROBE_DEVICE_NAME);
      | ^~~~~~~~~~~
In file included from ./include/linux/device.h:31,
                 from ./include/linux/cdev.h:8,
                 from /var/lib/dkms/sysdig/0.27.1/build/main.c:26:
./include/linux/device/class.h:230:54: note: expected ‘const char *’ but argument is of type ‘struct module *’
  230 | struct class * __must_check class_create(const char *name);
      | ~~~~~~~~~~~~^~~~
/var/lib/dkms/sysdig/0.27.1/build/main.c:2484:23: error: too many arguments to function ‘class_create’
 2484 | g_ppm_class = class_create(THIS_MODULE, PROBE_DEVICE_NAME);
      | ^~~~~~~~~~~~
./include/linux/device/class.h:230:29: note: declared here
  230 | struct class * __must_check class_create(const char *name);
      | ^~~~~~~~~~~~
cc1: some warnings being treated as errors
make[2]: *** [scripts/Makefile.build:251: /var/lib/dkms/sysdig/0.27.1/build/main.o] Error 1
make[2]: *** Waiting for unfinished jobs....
make[1]: *** [/usr/src/linux-headers-6.5.0-15-generic/Makefile:2037: /var/lib/dkms/sysdig/0.27.1/build] Error 2
make: *** [Makefile:234: __sub-make] Error 2
make: Leaving directory '/usr/src/linux-headers-6.5.0-15-generic'

[ Test Plan ]

This needs to be done on both the hwe kernel (v6.5) and the generic kernel (v5.15) to ensure it works on both.

* install sysdig (which will also install sysdig-dkms as dependency)
* successfull installation will mean the build failure has been fixed.

We need to do a basic test to see sysdig is still working.
* Give the command "sudo sysdig proc.name=ls" on one terminal
* On another terminal give the command "ls"
* The first terminal should now show the debug information about "ls".

[ Where problems could occur ]

 * This change is only affecting the users of hwe kernel (v6.5) and the only change is in the way the class is created. The class will be created when the module is loaded. So, if there is no error in loading the module then the user should not see any regression in normal operation.

[ Other Info ]

 * The change in the upstream linux kernel has been done via: https://<email address hidden>/
 * Patch not forwarded upstream sysdig is now using "falcosecurity".

[ Original Bug Description ]

This appears to happen upon the installation of kernel updates. It has occurring for some time, having been witness on multiple systems running jammy (Ubuntu 22.04 LTS).

Please see Ubuntu and package version info below.

$ cat /etc/os-release
PRETTY_NAME="Ubuntu 22.04.3 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.3 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=jammy

$ apt policy sysdig-dkms
sysdig-dkms:
  Installed: 0.27.1-0.3ubuntu0.2
  Candidate: 0.27.1-0.3ubuntu0.2
  Version table:
 *** 0.27.1-0.3ubuntu0.2 500
        500 http://gb.archive.ubuntu.com/ubuntu jammy-updates/universe amd64 Packages
        500 http://gb.archive.ubuntu.com/ubuntu jammy-updates/universe i386 Packages
        100 /var/lib/dpkg/status
     0.27.1-0.3build1 500
        500 http://gb.archive.ubuntu.com/ubuntu jammy/universe amd64 Packages
        500 http://gb.archive.ubuntu.com/ubuntu jammy/universe i386 Packages

$ apt policy linux-image-$(uname -r)
linux-image-6.5.0-14-generic:
  Installed: 6.5.0-14.14~22.04.1
  Candidate: 6.5.0-14.14~22.04.1
  Version table:
 *** 6.5.0-14.14~22.04.1 500
        500 http://gb.archive.ubuntu.com/ubuntu jammy-updates/main amd64 Packages
        500 http://security.ubuntu.com/ubuntu jammy-security/main amd64 Packages
        100 /var/lib/dpkg/status

ProblemType: Package
DistroRelease: Ubuntu 22.04
Package: sysdig-dkms 0.27.1-0.3ubuntu0.2
ProcVersionSignature: Ubuntu 6.5.0-14.14~22.04.1-generic 6.5.3
Uname: Linux 6.5.0-14-generic x86_64
ApportVersion: 2.20.11-0ubuntu82.5
Architecture: amd64
CasperMD5CheckResult: pass
DKMSKernelVersion: 6.5.0-15-generic
Date: Thu Jan 25 16:35:09 2024
DuplicateSignature: dkms:sysdig-dkms:0.27.1-0.3ubuntu0.2:./include/linux/export.h:29:22: error: passing argument 1 of ‘class_create’ from incompatible pointer type [-Werror=incompatible-pointer-types]
InstallationDate: Installed on 2023-01-27 (362 days ago)
InstallationMedia: Ubuntu 22.04.1 LTS "Jammy Jellyfish" - Release amd64 (20220809.1)
PackageArchitecture: all
PackageVersion: 0.27.1-0.3ubuntu0.2
Python3Details: /usr/bin/python3.10, Python 3.10.12, python3-minimal, 3.10.6-1~22.04
PythonDetails: N/A
RebootRequiredPkgs: Error: path contained symlinks.
RelatedPackageVersions:
 dpkg 1.21.1ubuntu2.2
 apt 2.4.11
SourcePackage: sysdig
Title: sysdig-dkms 0.27.1-0.3ubuntu0.2: sysdig kernel module failed to build
UpgradeStatus: No upgrade log present (probably fresh install)

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Alex Kates (squidx)]

FWIW, this install is on an old iMac
$ sudo lshw
ubuntu-jellyfish
    description: All In One
    product: iMac16,2
    vendor: Apple Inc.
    version: 1.0
    serial: C02RX65FGG78
    width: 64 bits
    capabilities: smbios-2.7 dmi-2.7 smp vsyscall32
    configuration: boot=normal chassis=all-in-one uuid=a549812c-e444-5f1c-etc etc

Here are some of my system details as above:

$ cat /etc/os-release
PRETTY_NAME="Ubuntu 22.04.3 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.3 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=jammy

$ apt policy sysdig-dkms
sysdig-dkms:
  Installed: 0.27.1-0.3ubuntu0.2
  Candidate: 0.27.1-0.3ubuntu0.2
  Version table:
 *** 0.27.1-0.3ubuntu0.2 500
        500 http://archive.linux.duke.edu/ubuntu jammy-updates/universe amd64 Packages
        500 http://archive.linux.duke.edu/ubuntu jammy-updates/universe i386 Packages
        100 /var/lib/dpkg/status
     0.27.1-0.3build1 500
        500 http://archive.linux.duke.edu/ubuntu jammy/universe amd64 Packages
        500 http://archive.linux.duke.edu/ubuntu jammy/universe i386 Packages

$ apt policy linux-image-$(uname -r)
linux-image-6.5.0-14-generic:
  Installed: 6.5.0-14.14~22.04.1
  Candidate: 6.5.0-14.14~22.04.1
  Version table:
 *** 6.5.0-14.14~22.04.1 500
        500 http://archive.linux.duke.edu/ubuntu jammy-updates/main amd64 Packages
        500 http://archive.linux.duke.edu/ubuntu jammy-security/main amd64 Packages
        100 /var/lib/dpkg/status

[Sudip Mukherjee (sudipmuk)]

debdiff for Jammy attached.

[Dave Jones (waveform)]

Thanks for the patch, Sudip! The patch looks reasonable and minimal (and nice to see justification of the not-forwarded status, which is also reasonable here), and builds cleanly.

The SRU test plan looks good (esp. that it includes testing under both affected and unaffected kernels, and is sufficiently simple even I can follow it!). Sponsoring for jammy.

[Robie Basak (racb)]

Hello Rob, or anyone else affected,

Accepted sysdig into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/sysdig/0.27.1-0.3ubuntu0.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Sudip Mukherjee (sudipmuk)]

I can confirm that the sysdig-dkms package in jammy-proposed has fixed the bug for me.

Test done:

1. Modify grub defauls to disable grub hidden timeout, and increase timeout
2. Install linux-generic to have both the kernel in the system
3. reboot to 5.15.0-97-generic kernel
3. Enable jammy-proposed
4. Install sysdig, confirm that the modules builds for both the kernels 5.15.0-97-generic and 6.5.0-21-generic
5. confirm with "sudo sysdig proc.name=ls" that sysdig is working
6. Confirm with uname -r that the kernel booted is 5.15.0-97-generic
7. reboot to 6.5.0-21-generic
8. confirm with uname that 6.5.0-21-generic is booted
9. confirm with "sudo sysdig proc.name=ls" that sysdig is working in hwe kernel

Test result: the errors with sysdig-dkms has been fixed.

Package tested:

$ dpkg -l | grep sysdig-dkms
ii sysdig-dkms 0.27.1-0.3ubuntu0.3 all system-level exploration and troubleshooting tool - kernel source

[Andreas Hasenack (ahasenack)]

Note that I saw that sysdig failed to build on riscv64, but it's not a regression: the release version was also an FTBFS in riscv64.

[Launchpad Janitor (janitor)]

This bug was fixed in the package sysdig - 0.27.1-0.3ubuntu0.3

---------------
sysdig (0.27.1-0.3ubuntu0.3) jammy; urgency=medium

  * Support linux kernel v6.5 (LP: #2051270)
    - d/p/support-linux-6.5.patch: remove module pointer.

 -- Sudip Mukherjee <email address hidden> Fri, 02 Feb 2024 19:27:19 +0000

[Andreas Hasenack (ahasenack)]

The verification of the Stable Release Update for sysdig has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.