DLPX-96702 Update delphix/bcc to be current with upstream iovisor/bcc

[tonynguien]

Problem

estat commands with zfs headers are failing, i.e. estat zio | zil | zpl | zvol | nfs-by-client | metaslab-alloc, see https://perforce.atlassian.net/browse/DLPX-96293.

The problem is Ubuntu bpfcc-tools and related packages the two years old, version 0.29, and support up to the 6.8 kernel (the main Ubuntu 24.04). Our images are running 6.14 kernel thus we get below forward declaration error

Solution

The solution is to build our own bcc packages which is what we did prior to the upgrade to 24.04 LTS.

The delphix/bcc is a couple years out of date so this PR merges with latest upstream iovisor/bcc and adds minor changes to properly build and rename Debian packages so they can cleanly replace Ubuntu bpfcc packages.

This change has a dependency on delphix/linux-pkg#389 which re-enables bcc build in linux-pkg.

Open question: How do we deal with MEND Security errors? Should I include those suggested changes into this PR or suppress the errors and fix them in another PR to keep the commit history cleaner?

Testing Done

Successful build against the delphix/bcc with merge changes.

delphix@ip-10-110-243-71:~ export DEFAULT_GIT_BRANCH=dlpx/pr/tonynguien/5047efc9-172e-480b-80ce-86a59c7935e7
delphix@ip-10-110-243-71:~ export DELPHIX_RELEASE_VERSION=2026.1.0.0
delphix@ip-10-110-243-71:~ ./buildpkg.sh bcc 2>&1 | tee build.delphix
delphix@ip-10-110-243-71:~/linux-pkg$ tail -n20 build.delphix

Running: cd /export/home/delphix/linux-pkg/packages/bcc/tmp

PACKAGE bcc: STAGE post_build_checks STARTED
Running: post_build_checks
Running: dpkg-deb -c bpfcc-lua_0.36.1-1+delphix.2026.02.27.22.53_all.deb | grep '/usr/share/doc/' | grep copyright
-rw-r--r-- root/root       193 2026-02-27 22:53 ./usr/share/doc/bpfcc-lua/copyright
Running: dpkg-deb -c bpfcc-tools_0.36.1-1+delphix.2026.02.27.22.53_all.deb | grep '/usr/share/doc/' | grep copyright
-rw-r--r-- root/root       193 2026-02-27 22:53 ./usr/share/doc/bpfcc-tools/copyright
Running: dpkg-deb -c libbpfcc-examples_0.36.1-1+delphix.2026.02.27.22.53_amd64.deb | grep '/usr/share/doc/' | grep copyright
-rw-r--r-- root/root       193 2026-02-27 22:53 ./usr/share/doc/libbpfcc-examples/copyright
Running: dpkg-deb -c libbpfcc_0.36.1-1+delphix.2026.02.27.22.53_amd64.deb | grep '/usr/share/doc/' | grep copyright
-rw-r--r-- root/root       193 2026-02-27 22:53 ./usr/share/doc/libbpfcc/copyright
Running: dpkg-deb -c python3-bpfcc_0.36.1-1+delphix.2026.02.27.22.53_all.deb | grep '/usr/share/doc/' | grep copyright
-rw-r--r-- root/root       193 2026-02-27 22:53 ./usr/share/doc/python3-bpfcc/copyright
PACKAGE bcc: STAGE post_build_checks COMPLETED in 1 seconds

Success: Package bcc has been built successfully.
Build products are in /export/home/delphix/linux-pkg/packages/bcc/tmp/artifacts

BCC programs run successfully

Sampling at 49 Hertz of all threads by user + kernel stack for 1 secs.
^C
    __raw_spin_unlock_irq+0x10 [kernel]
    __raw_spin_unlock_irq+0x10 [kernel]
    process_one_work+0x15d [kernel]
    worker_thread+0x2e5 [kernel]
    kthread+0xe7 [kernel]
    ret_from_fork+0x44 [kernel]

Some estat commands are still failing though that will be separately tracked/addressed with https://perforce.atlassian.net/browse/DLPX-96701

delphix@ip-10-110-223-173:~$ sudo estat zpl 2
In file included from /virtual/main.c:62:
In file included from /usr/src/zfs-6.14.0-1018-dx2025121319-a7d298781-aws/include/sys/spa_impl.h:42:
/usr/src/zfs-6.14.0-1018-dx2025121319-a7d298781-aws/include/sys/vdev_raidz.h:43:8: error: redefinition of 'kernel_param'
   43 | struct kernel_param {};
      |        ^
include/linux/moduleparam.h:69:8: note: previous definition is here
   69 | struct kernel_param {
      |        ^
/virtual/main.c:102:2: error: use of undeclared identifier 'zfsvfs_t'
  102 |         zfsvfs_t *zfsvfs = zn->z_inode.i_sb->s_fs_info;
      |         ^
/virtual/main.c:102:12: error: use of undeclared identifier 'zfsvfs'
  102 |         zfsvfs_t *zfsvfs = zn->z_inode.i_sb->s_fs_info;
      |                   ^
/virtual/main.c:102:23: error: incomplete definition of type 'struct znode'
  102 |         zfsvfs_t *zfsvfs = zn->z_inode.i_sb->s_fs_info;
      |                            ~~^
/usr/src/zfs-6.14.0-1018-dx2025121319-a7d298781-aws/include/sys/zfs_acl.h:205:8: note: forward declaration of 'struct znode'
  205 | struct znode;
      |        ^
/virtual/main.c:104:19: error: use of undeclared identifier 'zfsvfs'
  104 |         objset_t *z_os = zfsvfs->z_os;
      |                          ^
5 errors generated.
Traceback (most recent call last):
  File "/usr/bin/estat", line 414, in <module>
    b = BPF(text=bpf_text, cflags=cflags, debug=debug_level)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/bcc/__init__.py", line 507, in __init__
    raise Exception("Failed to compile BPF module %s" % (src_file or "<text>"))
Exception: Failed to compile BPF module <text>

[mend-for-github-com]

Mend Code Security Check

New finding (1 of 10)

The Mend Code Security Check of your branch failed because of a Buffer Overflow finding in this line.

Severity	Vulnerability Type	CWE	File	Data Flows	Detected
High	Buffer Overflow	CWE-121	gethostlatency.c:150	1	2026-02-27 09:59pm
Vulnerable Code bcc/libbpf-tools/gethostlatency.c Lines 145 to 150 in 6f3d96e continue; filename = strrchr(buf, '/') + 1; if (sscanf(filename, "libc-%f.so", &version) == 1 || sscanf(filename, "libc.so.%f", &version) == 1) { if (target_pid == 0) { memcpy(path, buf, strlen(buf)); 1 Data Flow/s detected bcc/libbpf-tools/gethostlatency.c Line 144 in 6f3d96e if (strchr(buf, '/') != buf) Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Buffer Overflow Training ● Videos    ▪ Secure Code Warrior Buffer Overflow Video Suppress Finding ... as False Alarm ... as Acceptable Risk Note: GitHub may take a few seconds to process actions triggered via checkboxes. Please wait until the change is visible before continuing.

[mend-for-github-com]

Mend Code Security Check

New finding (2 of 10)

The Mend Code Security Check of your branch failed because of a Buffer Overflow finding in this line.

Severity	Vulnerability Type	CWE	File	Data Flows	Detected
High	Buffer Overflow	CWE-121	bcc_proc.c:509	1	2026-02-27 09:59pm
Vulnerable Code bcc/src/cc/bcc_proc.c Lines 504 to 509 in 6f3d96e const size_t mapnamelen = strlen(mapname); if (mapnamelen >= PATH_MAX) { fprintf(stderr, "Found mapped library path is too long\n"); break; } found = true; 1 Data Flow/s detected bcc/src/cc/bcc_proc.c Line 492 in 6f3d96e if (!fgets(endline, sizeof(endline), fp)) bcc/src/cc/bcc_proc.c Line 494 in 6f3d96e bcc/src/cc/bcc_proc.c Line 503 in 6f3d96e (!has_so && strstr(mapname, search2)))) { bcc/src/cc/bcc_proc.c Line 509 in 6f3d96e found = true; Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Buffer Overflow Training ● Videos    ▪ Secure Code Warrior Buffer Overflow Video Suppress Finding ... as False Alarm ... as Acceptable Risk Note: GitHub may take a few seconds to process actions triggered via checkboxes. Please wait until the change is visible before continuing.

[mend-for-github-com]

Mend Code Security Check

New finding (3 of 10)

The Mend Code Security Check of your branch failed because of a Buffer Overflow finding in this line.

Severity	Vulnerability Type	CWE	File	Data Flows	Detected
High	Buffer Overflow	CWE-121	trace_helpers.c:1334	1	2026-02-27 09:59pm
Vulnerable Code bcc/libbpf-tools/trace_helpers.c Lines 1329 to 1334 in 6f3d96e if (!n) { err = -errno; goto cleanup; } n = snprintf(buf, buf_len, "loadavg: %s", avg); 1 Data Flow/s detected bcc/libbpf-tools/tcptop.c Line 227 in 6f3d96e if (pid_maxlen < 6) bcc/libbpf-tools/trace_helpers.c Line 1315 in 6f3d96e int str_loadavg(char *buf, size_t buf_len) bcc/libbpf-tools/trace_helpers.c Line 1334 in 6f3d96e n = snprintf(buf, buf_len, "loadavg: %s", avg); Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Buffer Overflow Training ● Videos    ▪ Secure Code Warrior Buffer Overflow Video Suppress Finding ... as False Alarm ... as Acceptable Risk Note: GitHub may take a few seconds to process actions triggered via checkboxes. Please wait until the change is visible before continuing.

[mend-for-github-com]

Mend Code Security Check

New finding (5 of 10)

The Mend Code Security Check of your branch failed because of a Out of Buffer Bounds Write finding in this line.

Severity	Vulnerability Type	CWE	File	Data Flows	Detected
High	Out of Buffer Bounds Write	CWE-787	gethostlatency.c:153	1	2026-02-27 09:59pm
Vulnerable Code bcc/libbpf-tools/gethostlatency.c Lines 148 to 153 in 6f3d96e sscanf(filename, "libc.so.%f", &version) == 1) { if (target_pid == 0) { memcpy(path, buf, strlen(buf)); } else { snprintf(proc_path, sizeof(proc_path), "/proc/%d/root%s", target_pid, buf); memcpy(path, proc_path, strlen(proc_path)); 1 Data Flow/s detected bcc/libbpf-tools/gethostlatency.c Line 153 in 6f3d96e memcpy(path, proc_path, strlen(proc_path)); Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Out of Buffer Bounds Write Training ● Videos    ▪ Secure Code Warrior Out of Buffer Bounds Write Video Suppress Finding ... as False Alarm ... as Acceptable Risk Note: GitHub may take a few seconds to process actions triggered via checkboxes. Please wait until the change is visible before continuing.

[mend-for-github-com]

Mend Code Security Check

New finding (6 of 10)

The Mend Code Security Check of your branch failed because of a Out of Buffer Bounds Write finding in this line.

Severity	Vulnerability Type	CWE	File	Data Flows	Detected
High	Out of Buffer Bounds Write	CWE-787	gethostlatency.c:152	1	2026-02-27 09:59pm
Vulnerable Code bcc/libbpf-tools/gethostlatency.c Lines 147 to 152 in 6f3d96e if (sscanf(filename, "libc-%f.so", &version) == 1 || sscanf(filename, "libc.so.%f", &version) == 1) { if (target_pid == 0) { memcpy(path, buf, strlen(buf)); } else { snprintf(proc_path, sizeof(proc_path), "/proc/%d/root%s", target_pid, buf); 1 Data Flow/s detected bcc/libbpf-tools/gethostlatency.c Line 152 in 6f3d96e snprintf(proc_path, sizeof(proc_path), "/proc/%d/root%s", target_pid, buf); Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Out of Buffer Bounds Write Training ● Videos    ▪ Secure Code Warrior Out of Buffer Bounds Write Video Suppress Finding ... as False Alarm ... as Acceptable Risk Note: GitHub may take a few seconds to process actions triggered via checkboxes. Please wait until the change is visible before continuing.

[mend-for-github-com]

Mend Code Security Check

New finding (7 of 10)

The Mend Code Security Check of your branch failed because of a Path/Directory Traversal finding in this line.

Severity	Vulnerability Type	CWE	File	Data Flows	Detected
High	Path/Directory Traversal	CWE-22	libbpf.c:1228	1	2026-02-27 09:59pm
Vulnerable Code bcc/src/cc/libbpf.c Lines 1223 to 1228 in 6f3d96e { int kfd = -1, res = -1; char ev_alias[256]; bool is_kprobe = strncmp("kprobe", event_type, 6) == 0; snprintf(buf, PATH_MAX, "%s/%s_events", get_tracefs_path(), event_type); 1 Data Flow/s detected bcc/src/cc/libbpf.c Line 1178 in 6f3d96e if (bytes <= 0 || bytes >= sizeof(buf)) { Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Path/Directory Traversal Training ● Videos    ▪ Secure Code Warrior Path/Directory Traversal Video ● Further Reading    ▪ OWASP Path Traversal    ▪ OWASP Input Validation Cheat Sheet Suppress Finding ... as False Alarm ... as Acceptable Risk Note: GitHub may take a few seconds to process actions triggered via checkboxes. Please wait until the change is visible before continuing.

[mend-for-github-com]

Mend Code Security Check

New finding (8 of 10)

The Mend Code Security Check of your branch failed because of a Path/Directory Traversal finding in this line.

Severity	Vulnerability Type	CWE	File	Data Flows	Detected
High	Path/Directory Traversal	CWE-22	bcc_elf.c:144	1	2026-02-27 09:59pm
Vulnerable Code bcc/src/cc/bcc_elf.c Lines 139 to 144 in 6f3d96e static int bcc_elf_file_open(const char *path, struct bcc_elf_file *out) { struct bcc_zip_archive *archive = NULL; struct bcc_zip_entry entry; int fd = -1; fd = open(path, O_RDONLY); 1 Data Flow/s detected bcc/src/cc/bcc_elf.c Line 731 in 6f3d96e symfs = getenv("BCC_SYMFS"); bcc/src/cc/bcc_elf.c Line 741 in 6f3d96e snprintf(fullpath, sizeof(fullpath), "%s/%s", symfs, path); bcc/src/cc/bcc_elf.c Line 139 in 6f3d96e static int bcc_elf_file_open(const char *path, struct bcc_elf_file *out) { bcc/src/cc/bcc_elf.c Line 144 in 6f3d96e fd = open(path, O_RDONLY); Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Path/Directory Traversal Training ● Videos    ▪ Secure Code Warrior Path/Directory Traversal Video ● Further Reading    ▪ OWASP Path Traversal    ▪ OWASP Input Validation Cheat Sheet Suppress Finding ... as False Alarm ... as Acceptable Risk Note: GitHub may take a few seconds to process actions triggered via checkboxes. Please wait until the change is visible before continuing.

[mend-for-github-com]

Mend Code Security Check

New finding (9 of 10)

The Mend Code Security Check of your branch failed because of a Server Side Request Forgery finding in this line.

Severity	Vulnerability Type	CWE	File	Data Flows	Detected
High	Server Side Request Forgery	CWE-918	web_server.py:27	1	2026-02-27 10:00pm
Vulnerable Code bcc/examples/networking/tcp_mon_block/src/web_server.py Lines 22 to 27 in 6f3d96e api = request.args["api"] except Exception as e: return "Missing api argument" # On expected connection to http://api.ipify.org the output here should be the server's public IP server_ip = requests.get(api).content.decode() 1 Data Flow/s detected bcc/examples/networking/tcp_mon_block/src/web_server.py Line 22 in 6f3d96e api = request.args["api"] Secure Code Warrior Training Material ● Training    ▪ Secure Code Warrior Server Side Request Forgery Training ● Videos    ▪ Secure Code Warrior Server Side Request Forgery Video Suppress Finding ... as False Alarm ... as Acceptable Risk Note: GitHub may take a few seconds to process actions triggered via checkboxes. Please wait until the change is visible before continuing.

[mend-for-github-com]

Mend Code Security Check

New finding (10 of 10)

The Mend Code Security Check of your branch failed because of a Uncontrolled Memory Allocation finding in this line.

Severity	Vulnerability Type	CWE	File	Data Flows	Detected
Low	Uncontrolled Memory Allocation	CWE-789	bcc_proc.c:152	1	2026-02-27 09:59pm
Vulnerable Code bcc/src/cc/bcc_proc.c Lines 147 to 152 in 6f3d96e entry.compression) { bcc_zip_archive_close(archive); return NULL; } char *result = malloc(strlen(path) + entry.name_length + 3); 1 Data Flow/s detected bcc/src/cc/bcc_proc.c Line 181 in 6f3d96e break; bcc/src/cc/bcc_proc.c Line 186 in 6f3d96e name = buf; bcc/src/cc/bcc_proc.c Line 132 in 6f3d96e uint32_t *offset) { bcc/src/cc/bcc_proc.c Line 135 in 6f3d96e "/proc/%d/root%s", pid, path); bcc/src/cc/bcc_proc.c Line 152 in 6f3d96e char *result = malloc(strlen(path) + entry.name_length + 3); Secure Code Warrior Training Material Suppress Finding ... as False Alarm ... as Acceptable Risk Note: GitHub may take a few seconds to process actions triggered via checkboxes. Please wait until the change is visible before continuing.