pkg/exitsnoop: hold raw_tp link to prevent from GC

The cilium/ebpf defines sys.FD's SetFinalizer to close fd when GC. Since the exec process's exit code needs memory-type exitsnoop, we should keep the reference on the raw_tp link. Otherwise, the exitsnoop will be gone and process's exit code will be wrong. Signed-off-by: Wei Fu <[email protected]>
fuweid · Apr 8, 2022 · ded339a · ded339a
1 parent a541c7f
commit ded339a
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 5 deletions.
diff --git a/pkg/exitsnoop/load.go b/pkg/exitsnoop/load.go
@@ -37,10 +37,6 @@ var (
 // NewStoreFromAttach only opens but not pinned in bpffs, which has common
 // functionality with EnsureRunning. I think we should use options to merge
 // two function in the future.
-//
-// FIXME(fuweid):
-//
-// How to close the link after close the store?
 func NewStoreFromAttach() (_ *Store, retErr error) {
 	spec, err := ebpf.LoadCollectionSpecFromReader(bytes.NewReader(progByteCode))
 	if err != nil {
@@ -63,7 +59,7 @@ func NewStoreFromAttach() (_ *Store, retErr error) {
 		}
 	}()
 
-	_, err = link.AttachRawTracepoint(link.RawTracepointOptions{
+	link, err := link.AttachRawTracepoint(link.RawTracepointOptions{
 		Name:    "sched_process_exit",
 		Program: collection.Programs[bpfProgName],
 	})
@@ -74,6 +70,7 @@ func NewStoreFromAttach() (_ *Store, retErr error) {
 	return &Store{
 		tracingTasks: collection.Maps[bpfMapTracingTasks],
 		exitedEvents: collection.Maps[bpfMapExitedEvents],
+		link:         link,
 	}, nil
 }
 

diff --git a/pkg/exitsnoop/map.go b/pkg/exitsnoop/map.go
@@ -5,6 +5,7 @@ import (
 	"path/filepath"
 
 	"github.com/cilium/ebpf"
+	"github.com/cilium/ebpf/link"
 )
 
 // TaskInfo is used to trace the target task.
@@ -51,6 +52,10 @@ func NewStore(bpffsRoot string) (*Store, error) {
 type Store struct {
 	tracingTasks *ebpf.Map
 	exitedEvents *ebpf.Map
+
+	// NOTE: It is only used to prevent the memory-type prog from go runtime
+	// GC. For the persisted-type, the field is nil.
+	link link.Link
 }
 
 func (store *Store) Trace(pid uint32, taskInfo *TaskInfo) error {
@@ -95,6 +100,9 @@ func (store *Store) DeleteExitedEvent(traceEventID uint64) error {
 func (store *Store) Close() error {
 	store.tracingTasks.Close()
 	store.exitedEvents.Close()
+	if store.link != nil {
+		store.link.Close()
+	}
 	return nil
 }