Skip to content

fix(modern_bpf): skip syscall -1#2938

Merged
poiana merged 1 commit intofalcosecurity:masterfrom
gnosek:fix-socketcall-modern-bpf
Apr 7, 2026
Merged

fix(modern_bpf): skip syscall -1#2938
poiana merged 1 commit intofalcosecurity:masterfrom
gnosek:fix-socketcall-modern-bpf

Conversation

@gnosek
Copy link
Copy Markdown
Contributor

@gnosek gnosek commented Apr 7, 2026

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind test

/kind feature

/kind sync

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area API-version

/area build

/area CI

/area driver-kmod

/area driver-modern-bpf

/area libscap-engine-kmod

/area libscap-engine-modern-bpf

/area libscap-engine-nodriver

/area libscap-engine-noop

/area libscap-engine-source-plugin

/area libscap-engine-savefile

/area libscap

/area libpman

/area libsinsp

/area tests

/area proposals

Does this PR require a change in the driver versions?

/version driver-API-version-major

/version driver-API-version-minor

/version driver-API-version-patch

/version driver-SCHEMA-version-major

/version driver-SCHEMA-version-minor

/version driver-SCHEMA-version-patch

What this PR does / why we need it:

syscall id -1 means the system call was interrupted or cancelled (e.g. by ptrace or a signal) and is not processed normally.

Unfortunately, we also picked -1 as the "syscall does not exist" value for socketcall on architectures that do not support it. This means that syscalls interrupted by signals were actually treated as socketcall and dispatched based on whatever happened to be in the registers.

This led to tons of bogus SOCKET_X (mostly, but not only) events being reported, filling the fd table with fds that would never get cleaned up (they never really existed so nobody closed them).

Combined with copying the fd table on creating a new process, this led to fd table size explosion (thousands of bogus fds copied to all children).

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

@gnosek
fix(modern_bpf): skip syscall -1
e0cf65f 
syscall id -1 means the system call was interrupted or cancelled
(e.g. by ptrace or a signal) and is not processed normally.

Unfortunately, we also picked -1 as the "syscall does not exist"
value for socketcall on architectures that do not support it.
This means that syscalls interrupted by signals were actually
treated as socketcall and dispatched based on whatever happened
to be in the registers.

This led to tons of bogus SOCKET_X (mostly, but not only) events
being reported, filling the fd table with fds that would never
get cleaned up (they never really existed so nobody closed them).

Combined with copying the fd table on creating a new process,
this led to fd table size explosion (thousands of bogus fds
copied to all children).

Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
@poiana poiana added kind/bug Something isn't working release-note-none labels Apr 7, 2026
@poiana poiana requested review from hbrueckner and terror96 April 7, 2026 13:18
@poiana poiana added the approved label Apr 7, 2026
@ekoops ekoops added this to the 0.24.0 milestone Apr 7, 2026
ekoops
ekoops approved these changes Apr 7, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@ekoops ekoops left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana poiana added the lgtm label Apr 7, 2026
@poiana
Copy link
Copy Markdown
Contributor

poiana commented Apr 7, 2026

LGTM label has been added.

DetailsGit tree hash: 1ff1e4e2e04b9f16f17b4f24027b3d4cea895812

@github-actions
Copy link
Copy Markdown

github-actions bot commented Apr 7, 2026

Perf diff from master - unit tests

    17.07%     -0.76%  [.] std::__shared_ptr<sinsp_threadinfo, (__gnu_cxx::_Lock_policy)2>::__shared_ptr(std::__weak_ptr<sinsp_threadinfo, (__gnu_cxx::_Lock_policy)2> const&, std::nothrow_t)
     9.90%     -0.69%  [.] sinsp_threadinfo::update_main_fdtable()
    13.52%     +0.57%  [.] std::__shared_count<(__gnu_cxx::_Lock_policy)2>::_M_get_use_count() const
    10.76%     +0.46%  [.] sinsp_threadinfo::get_main_thread()
     4.36%     +0.36%  [.] thread_group_info::get_first_thread() const
     3.22%     -0.19%  [.] sinsp_thread_manager::create_thread_dependencies(std::shared_ptr<sinsp_threadinfo> const&)
    10.17%     +0.16%  [.] std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_add_ref_lock_nothrow()
     8.33%     +0.16%  [.] sinsp_threadinfo::get_fd_table()
     7.07%     -0.15%  [.] std::__shared_count<(__gnu_cxx::_Lock_policy)2>::__shared_count(std::__weak_count<(__gnu_cxx::_Lock_policy)2> const&, std::nothrow_t)
     8.99%     +0.10%  [.] std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release()

Heap diff from master - unit tests

peak heap memory consumption: 0B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Heap diff from master - scap file

peak heap memory consumption: 0B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Benchmarks diff from master

Comparing gbench_data.json to /root/actions-runner/_work/libs/libs/build/gbench_data.json
Benchmark                                                         Time             CPU      Time Old      Time New       CPU Old       CPU New
----------------------------------------------------------------------------------------------------------------------------------------------
BM_sinsp_split_mean                                            -0.0113         -0.0112           246           243           245           243
BM_sinsp_split_median                                          -0.0138         -0.0140           246           243           246           243
BM_sinsp_split_stddev                                          -0.1891         -0.1888             2             2             2             2
BM_sinsp_split_cv                                              -0.1798         -0.1796             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_mean                  -0.0184         -0.0182            70            68            70            68
BM_sinsp_concatenate_paths_relative_path_median                -0.0215         -0.0213            69            68            69            68
BM_sinsp_concatenate_paths_relative_path_stddev                +0.0048         +0.0006             1             1             1             1
BM_sinsp_concatenate_paths_relative_path_cv                    +0.0236         +0.0191             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_mean                     +0.0141         +0.0142            41            42            41            42
BM_sinsp_concatenate_paths_empty_path_median                   +0.0579         +0.0578            40            42            40            42
BM_sinsp_concatenate_paths_empty_path_stddev                   -0.1089         -0.1024             1             1             1             1
BM_sinsp_concatenate_paths_empty_path_cv                       -0.1213         -0.1150             0             0             0             0
BM_sinsp_concatenate_paths_absolute_path_mean                  -0.0059         -0.0059            69            69            69            68
BM_sinsp_concatenate_paths_absolute_path_median                -0.0069         -0.0069            69            68            69            68
BM_sinsp_concatenate_paths_absolute_path_stddev                +0.0565         +0.0592             0             0             0             0
BM_sinsp_concatenate_paths_absolute_path_cv                    +0.0628         +0.0654             0             0             0             0

@irozzo-1A irozzo-1A self-assigned this Apr 7, 2026
@irozzo-1A irozzo-1A self-requested a review April 7, 2026 13:24
irozzo-1A
irozzo-1A approved these changes Apr 7, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@irozzo-1A irozzo-1A left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@github-project-automation github-project-automation bot moved this from Todo to In progress in Falco Roadmap Apr 7, 2026
@poiana
Copy link
Copy Markdown
Contributor

poiana commented Apr 7, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ekoops, gnosek, irozzo-1A

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@codecov
Copy link
Copy Markdown

codecov bot commented Apr 7, 2026 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.90%. Comparing base (64306fa) to head (e0cf65f).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files 
@@           Coverage Diff           @@
##           master    #2938   +/-   ##
=======================================
  Coverage   74.90%   74.90%           
=======================================
  Files         297      297           
  Lines       31498    31498           
  Branches     4979     4979           
=======================================
  Hits        23595    23595           
  Misses       7903     7903
Flag Coverage Δ
libsinsp 74.90% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@poiana poiana merged commit 2708205 into falcosecurity:master Apr 7, 2026
54 checks passed
@github-project-automation github-project-automation bot moved this from In progress to Done in Falco Roadmap Apr 7, 2026
@ekoops ekoops modified the milestones: 0.24.0, 0.23.2 Apr 8, 2026
@ekoops ekoops mentioned this pull request Apr 8, 2026
Merged
@BrewTestBot BrewTestBot mentioned this pull request Apr 8, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@irozzo-1A irozzo-1A irozzo-1A approved these changes

@ekoops ekoops ekoops approved these changes

@hbrueckner hbrueckner Awaiting requested review from hbrueckner

@terror96 terror96 Awaiting requested review from terror96

Assignees

@irozzo-1A irozzo-1A

@ekoops ekoops

Labels

approved area/driver-modern-bpf dco-signoff: yes kind/bug Something isn't working lgtm release-note-none size/S

Projects

Falco Roadmap
Status: Done

Milestone

0.23.2

Development

Successfully merging this pull request may close these issues.

4 participants

@gnosek @poiana @irozzo-1A @ekoops