aquasecurity / aquasecurity/tracee

ARM64: eBPF crashes when Tracee starts with flags `pprof` and `pyroscope`

Open
#4,556 3 comments 0 reactions 0 assignees View on GitHub
kind/bug
Dominant language
Go
Stars
4.6k
Forks
507
Avg merge
2d 8h
Merged PRs (30d)
9

Description

## Description
If both flags are used to start Tracee, eBPF will crash:
```
sudo ./dist/tracee --pprof --pyroscope
```

eBPF Crash Snippet:
```
1697: (07) r1 += -136
; return BPF_CORE_READ(dentry, d_parent);
1698: (b7) r2 = 8
1699: (85) call bpf_probe_read_kernel#113
last_idx 1699 first_idx 1692
regs=4 stack=0 before 1698: (b7) r2 = 8
; if (dentry == mnt_root || dentry == d_parent) {
1700: (79) r3 = *(u64 *)(r10 -88)
processed 1960 insns (limit 1000000) max_states_per_insn 1 total_states 135 peak_states 135 mark_read 107
-- END PROG LOAD LOG --
{"level":"warn","ts":1737988051.9114196,"msg":"libbpf: prog 'sys_enter_submit': failed to load: -11"}
{"level":"warn","ts":1737988051.9122999,"msg":"libbpf: failed to load object ''"}
{"level":"fatal","ts":1737988051.9231942,"msg":"Tracee runner failed","error":"cmd.Runner.Run: error initializing Tracee: ebpf.(*Tracee).Init: ebpf.(*Tracee).initBPF: failed to load BPF object: resource temporarily unavailable"}
```

Note: If Tracee is started with `--pprof` or `--pyroscope` separately, no crash occurs. The crash only happens when both flags are used together.

## Output of `tracee version`:

```
Tracee version: main-a6ea82edf
```

## Output of `uname -a`:

```
Linux ip-172-31-41-137 5.15.0-67-generic #74-Ubuntu SMP Wed Feb 22 14:14:39 UTC 2023 aarch64 aarch64 aarch64 GNU/Linux
```

## Additional details
Works in kernel 6.8 and 6.12 (arm64)

Contributor guide

Open the contributing guide

Research direction

Start by reproducing `sudo ./dist/tracee --pprof --pyroscope` on the reported ARM64 Ubuntu 5.15 kernel, then compare it with each flag separately and with kernels 6.8 or 6.12. Done means Tracee starts successfully with both flags and no eBPF object load failure.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux
Domain
operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.