From b62d0eaee6bc26be662812d93a4dff79ad4daa07 Mon Sep 17 00:00:00 2001 From: Yair Etziony Date: Sun, 3 May 2026 01:01:18 +0200 Subject: [PATCH] fix(ebpf): check container exit_code read --- ebpf/container_monitor.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ebpf/container_monitor.c b/ebpf/container_monitor.c index 536c55f8..acd0d2f0 100644 --- a/ebpf/container_monitor.c +++ b/ebpf/container_monitor.c @@ -131,7 +131,8 @@ int handle_exit(struct trace_event_raw_sched_process_exit *ctx) { // Read exit_code from task_struct (CO-RE: field offset resolved at load time via BTF) // exit_code format: (exit_code << 8) | signal __u32 exit_code = 0; - bpf_core_read(&exit_code, sizeof(exit_code), &task->exit_code); + if (bpf_core_read(&exit_code, sizeof(exit_code), &task->exit_code) != 0) + return 0; __s32 code = exit_code >> 8; __s32 sig = exit_code & 0x7F;