Skip to content

fix(ebpf): check bpf_core_read return for task->exit_code#633

Open
yairfalse wants to merge 1 commit into
mainfrom
fix/container-exit-code-read-check
Open

fix(ebpf): check bpf_core_read return for task->exit_code#633
yairfalse wants to merge 1 commit into
mainfrom
fix/container-exit-code-read-check

Conversation

@yairfalse
Copy link
Copy Markdown
Collaborator

Summary

  • Check the return value when reading task->exit_code in the container observer.
  • Return early when the CO-RE read fails instead of processing the zero initializer.

Why

A failed task->exit_code read left exit_code at zero, making the BPF-side clean-exit filter silently drop the event as if the process exited normally.

Test plan

  • cargo check --workspace passes
  • eBPF program still compiles with: clang -O2 -g -target bpf -D__TARGET_ARCH_x86 -I ebpf/headers -c ebpf/container_monitor.c -o /tmp/out.o
  • failed task->exit_code reads are no longer indistinguishable from clean exits

Copy link
Copy Markdown
Collaborator Author

@yairfalse yairfalse left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM (review-only — self-authored, can't formally approve).

Minimum-viable correctness fix — exactly the two-line change the bug needed. Failed bpf_core_read is now distinguishable from a clean exit (which the BPF-side filter at line 140 was previously masking).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant