fix a minor leak in ebfp fdinstall_pids table

when we got an fd install event but the pid was dead by time we
processed it, we would fail to remove the watcher for that pid from
the fdinstall_pids table.

This is a minor, and bounded, leak, since the table only contains pids
that were alive when we initialized ebpf. And this change only plugs
that leak very partially, since we will never remove pids that die
while sitting in accept().
This commit is contained in:
Matthias Radestock
2017-07-10 15:31:11 +01:00
parent e2cbe7ac26
commit 3883d8f1af

View File

@@ -172,6 +172,9 @@ func tupleFromPidFd(pid int, fd int) (tuple fourTuple, netns string, ok bool) {
}
func (t *EbpfTracker) handleFdInstall(ev tracer.EventType, pid int, fd int) {
if !process.IsProcInAccept("/proc", strconv.Itoa(pid)) {
t.tracer.RemoveFdInstallWatcher(uint32(pid))
}
tuple, netns, ok := tupleFromPidFd(pid, fd)
log.Debugf("EbpfTracker: got fd-install event: pid=%d fd=%d -> tuple=%s netns=%s ok=%v", pid, fd, tuple, netns, ok)
if !ok {
@@ -183,9 +186,6 @@ func (t *EbpfTracker) handleFdInstall(ev tracer.EventType, pid int, fd int) {
pid: pid,
networkNamespace: netns,
}
if !process.IsProcInAccept("/proc", strconv.Itoa(pid)) {
t.tracer.RemoveFdInstallWatcher(uint32(pid))
}
}
func (t *EbpfTracker) handleConnection(ev tracer.EventType, tuple fourTuple, pid int, networkNamespace string) {