aquasecurity / aquasecurity/tracee

fix(build): disable -race on arm64 due to Go 1.26.2 linker bug

Closed
#5,287 0 comments 0 reactions 0 assignees View on GitHub
kind/bug
Dominant language
Go
Stars
4.6k
Forks
507
Avg merge
2d 8h
Merged PRs (30d)
9

Description

## Go 1.26.2 breaks -race on arm64 (golang/go#78573)

### Problem

Bumping the Go toolchain to 1.26.2 causes link failures on all arm64 test targets that use `-race`. The Go race detector embeds a pre-built TSAN runtime (`gotsan.cpp` compiled into `race_linux_arm64.syso`) that, starting with 1.26.2, references LSE outline-atomics symbols with `_sync` ordering:

```
__aarch64_ldadd8_sync
__aarch64_swp1_sync
__aarch64_cas4_sync
__aarch64_ldset8_sync
__aarch64_ldclr8_sync
... (many more)
```

These symbols are not resolved by the external linker (clang 19) used in our CI, even though GCC 11 is available on the runners. The Go linker invokes `/usr/bin/clang` as the external linker for CGO builds, and clang links against compiler-rt rather than libgcc. The compiler-rt version shipped with clang 19 does not provide the `_sync` variants of the outline-atomics helpers.

This affects the aarch64 kernel-test matrix (kernels 5.10, 5.15, and others) where `make test-compatibility` is called as the first step of the e2e test action.

### Upstream

This is tracked upstream as golang/go#78573. The same breakage is confirmed by multiple reporters on Go 1.26.2 and 1.25.9 across Amazon Linux 2, Rocky Linux 9, and Bazel hermetic toolchains.

### Workaround

Introduced `GO_TEST_RACE` variable in the Makefile, set to `-race` only when `GO_ARCH != arm64`. All six test targets (`test-unit`, `test-types`, `test-common`, `test-integration`, `test-compatibility`, `test-performance`) use `$(GO_TEST_RACE)` instead of a hardcoded `-race` flag.

Race detection can be forced on arm64 for testing with:

make test-compatibility GO_TEST_RACE=-race

### Re-enable

Once golang/go#78573 is fixed (expected in Go 1.26.3 or a revised 1.26.2), remove the `ifneq` guard in the Makefile and restore unconditional `-race`.

### Affected CI

- `.github/workflows/pr.yaml` -> `kernel-tests` job -> aarch64 matrix entries
- `.github/actions/run-e2e-tests/action.yaml` -> `make test-compatibility`

### Error (abbreviated)

```
gotsan.cpp:(.text+0x12ec): undefined reference to `__aarch64_ldadd8_sync'
gotsan.cpp:(.text+0x1324): undefined reference to `__aarch64_swp1_sync'
gotsan.cpp:(.text+0x2c00): undefined reference to `__aarch64_ldadd4_sync'
...
clang: error: linker command failed with exit code 1 (use -v to see invocation)
FAIL github.com/aquasecurity/tracee/tests/compatibility [build failed]
```

Contributor guide

Open the contributing guide

Research direction

Start with the Makefile and inspect the six named test targets that use the race flag. Check the arm64 path alongside the kernel-tests matrix in .github/workflows/pr.yaml and the make test-compatibility entry in .github/actions/run-e2e-tests/action.yaml. Done means arm64 compatibility tests no longer hit the linker failure while other architectures retain race testing.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux
Domain
build-system, ci-cd
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.