Skip to content

[CORE-643] fix: handle exec and fork from non-leader threads#46

Merged
tamirdavid1 merged 8 commits intomainfrom
bpf_maps_cleanups
Mar 2, 2026
Merged

[CORE-643] fix: handle exec and fork from non-leader threads#46
tamirdavid1 merged 8 commits intomainfrom
bpf_maps_cleanups

Conversation

@RonFed
Copy link
Copy Markdown
Collaborator

@RonFed RonFed commented Feb 26, 2026

This PR contains 2 main improvements:

  • avoid reporting to user space on failed execs.
  • properly handle exec events performed by not the main thread. This was an edge case we didn't properly handled - since the pid as seen in the exec entry is not the actual one used in this case. Since after an exec by a non-leader thread - all the other threads are terminated, and the new execution will be under the thread group leader - tgid.
  • properly handle fork events done by not the main thread. The fork probe is updated to look the parent tgid and not the parent pid.

additional improvemts

  • add an ongoing_execs map to only correlate the exec exit and exec entry probes. - The existing tracked_pids maps are only updated at the exec return probe - to avoid adding failed exec events to them.
  • add test cases for a failed exec and for an exec done by a non leader thread.
  • add assertions for empty maps after these use cases - to make sure no leakage in the eBPF maps.

@RonFed RonFed changed the title Bpf maps cleanups WIP: handle exec from non-leader thread Feb 26, 2026
@RonFed RonFed changed the title WIP: handle exec from non-leader thread [CORE-643] fix: handle exec from non-leader thread Feb 27, 2026
@RonFed RonFed marked this pull request as ready for review February 27, 2026 10:50
@RonFed RonFed changed the title [CORE-643] fix: handle exec from non-leader thread [CORE-643] fix: handle exec and fork from non-leader threads Feb 28, 2026
@tamirdavid1 tamirdavid1 merged commit 81f699d into main Mar 2, 2026
14 checks passed
tamirdavid1 added a commit to odigos-io/odigos that referenced this pull request Mar 2, 2026
…dling (#4321)

#### What this PR does / why we need it:
<!--
Please add a meaningful description for future maintainers on what this
change does and why we need it.
-->
Following this pull request in runtime-detector
odigos-io/runtime-detector#46

#### Changelog entry: Does this PR introduce a user-facing bug fix,
feature, dependency update, or breaking change??
<!--
This section will go in the release notes for this version. Is this
something users should be able to find easily?
If no, just write "NONE" in the release-note block below.
If yes, please add a release note in the block below describing this in
1-2 sentences for our changelog.
-->

```release-note
Properly handle exec and fork events performed by not the main thread
```
tamirdavid1 added a commit to tamirdavid1/odigos that referenced this pull request Mar 2, 2026
…dling (odigos-io#4321)

<!--
Please add a meaningful description for future maintainers on what this
change does and why we need it.
-->
Following this pull request in runtime-detector
odigos-io/runtime-detector#46

feature, dependency update, or breaking change??
<!--
This section will go in the release notes for this version. Is this
something users should be able to find easily?
If no, just write "NONE" in the release-note block below.
If yes, please add a release note in the block below describing this in
1-2 sentences for our changelog.
-->

```release-note
Properly handle exec and fork events performed by not the main thread
```
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants