[bug] Kernel stack traces show stale or incorrect symbols for dynamically loaded BPF programs

[Gandem]

Currently, the profiler only refreshes symbols from /proc/kallsyms when kernel modules are added/removed via kobject events (here). However, BPF programs do not trigger kobject "module" events when loaded/unloaded, even though the kernel dynamically adds their symbols to /proc/kallsyms.

As a consequence, on systems where eBPF programs are frequently loaded/unloaded (e.g., in Kubernetes environments with Cilium, or other BPF-based tools), this leads to stale or incorrect symbols in kernel stack traces.

We could potentially add kprobes to bpf_ksym_add and bpf_ksym_del to trigger kallsyms refresh when BPF programs are loaded/unloaded.

Alternatively, we could also monitor PERF_RECORD_BPF_EVENT and trigger periodic re-reading of /proc/kallsyms as is done for standard kernel modules.