Skip to content

Conversation

@JoukoVirtanen
Copy link

@JoukoVirtanen JoukoVirtanen commented Nov 13, 2025

Description

Fixes a verifier error, by adding null checks.

Checklist

  • Investigated and inspected CI test results
  • Updated documentation accordingly

Automated testing

  • Added unit tests
  • Added integration tests
  • Added regression tests

If any of these don't apply, please comment below.

Testing Performed

Created an infra cluster with flavor gke-default. The kernel version was 6.8.0-1033-gke. There was the following error in the fact logs

[DEBUG 2025-11-13T01:09:09Z] (/cachi2/output/deps/cargo/aya-obj-0.2.1/src/relocation.rs:443) finished relocating program `trace_path_unlink` function `trace_path_unlink`
Error: the BPF_PROG_LOAD syscall failed. Verifier output: 0: R1=ctx() R10=fp0
; int BPF_PROG(trace_file_open, struct file* file) {
0: (79) r7 = *(u64 *)(r1 +0)
func 'bpf_lsm_file_open' arg0 has btf_id 602 type STRUCT 'file'
1: R1=ctx() R7_w=trusted_ptr_file()
1: (b7) r6 = 0                        ; R6_w=0
; unsigned int zero = 0;
2: (63) *(u32 *)(r10 -24) = r6        ; R6_w=0 R10=fp0 fp-24=????0
3: (bf) r2 = r10                      ; R2_w=fp0 R10=fp0
4: (07) r2 += -24                     ; R2_w=fp-24
; return bpf_map_lookup_elem(&metrics, &zero);
5: (18) r1 = 0xffff89a3c6a15c00       ; R1_w=map_ptr(map=metrics,ks=4,vs=80)
7: (85) call bpf_map_lookup_elem#1    ; R0_w=map_value_or_null(id=1,map=metrics,ks=4,vs=80)
; m->file_open.total++;
8: (79) r1 = *(u64 *)(r0 +0)
R0 invalid mem access 'map_value_or_null'
verification time 176 usec
stack depth 24
processed 8 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0


Caused by:
    Permission denied (os error 13)

After making the changes here deployed ACS again, and fact did not crash.

@JoukoVirtanen JoukoVirtanen changed the base branch from main to jv-ROX-31434-add-node-to-file-system-events November 13, 2025 05:01
@JoukoVirtanen JoukoVirtanen marked this pull request as ready for review November 13, 2025 05:34
Copy link
Collaborator

@Molter73 Molter73 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These changes can also be found in #125, please verify if that PR works for the kernel you are working on and help get that PR merged, since it addresses a lot more than just these verifier issues.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants