try sched_process_exit now that we worked around the race.

elastic · Feb 4, 2025 · b3b9d6c · b3b9d6c
1 parent 67d4e36
commit b3b9d6c
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 15 deletions.
diff --git a/GPL/Events/Process/Probe.bpf.c b/GPL/Events/Process/Probe.bpf.c
@@ -205,7 +205,8 @@ static int taskstats_exit__enter(const struct task_struct *task, int group_dead)
     return 0;
 }
 
-static int do_exit(const struct task_struct *task)
+SEC("tp_btf/sched_process_exit")
+int BPF_PROG(sched_process_exit, const struct task_struct *task)
 {
     struct ebpf_process_exit_event *event;
 
@@ -256,18 +257,6 @@ int BPF_KPROBE(kprobe__taskstats_exit, const struct task_struct *task, int group
     return taskstats_exit__enter(task, group_dead);
 }
 
-SEC("kprobe/proc_exit_connector")
-int BPF_KPROBE(kprobe__proc_exit_connector, const struct task_struct *task)
-{
-    return do_exit(task);
-}
-
-SEC("fentry/proc_exit_connector")
-int BPF_PROG(fentry__proc_exit_connector, const struct task_struct *task)
-{
-    return do_exit(task);
-}
-
 // tracepoint/syscalls/sys_[enter/exit]_[name] tracepoints are not available
 // with BTF type information, so we must use a non-BTF tracepoint
 SEC("tracepoint/syscalls/sys_exit_setsid")

diff --git a/non-GPL/Events/Lib/EbpfEvents.c b/non-GPL/Events/Lib/EbpfEvents.c
@@ -373,7 +373,6 @@ static inline int probe_set_autoload(struct btf *btf, struct EventProbe_bpf *obj
         err = err ?: bpf_program__set_autoload(obj->progs.kprobe__vfs_rename, false);
         err = err ?: bpf_program__set_autoload(obj->progs.kretprobe__vfs_rename, false);
         err = err ?: bpf_program__set_autoload(obj->progs.kprobe__taskstats_exit, false);
-        err = err ?: bpf_program__set_autoload(obj->progs.kprobe__proc_exit_connector, false);
         err = err ?: bpf_program__set_autoload(obj->progs.kprobe__commit_creds, false);
         err = err ?: bpf_program__set_autoload(obj->progs.kretprobe__inet_csk_accept, false);
         err = err ?: bpf_program__set_autoload(obj->progs.kprobe__tcp_v4_connect, false);
@@ -398,7 +397,6 @@ static inline int probe_set_autoload(struct btf *btf, struct EventProbe_bpf *obj
         err = err ?: bpf_program__set_autoload(obj->progs.fentry__vfs_rename, false);
         err = err ?: bpf_program__set_autoload(obj->progs.fexit__vfs_rename, false);
         err = err ?: bpf_program__set_autoload(obj->progs.fentry__taskstats_exit, false);
-        err = err ?: bpf_program__set_autoload(obj->progs.fentry__proc_exit_connector, false);
         err = err ?: bpf_program__set_autoload(obj->progs.fentry__commit_creds, false);
         err = err ?: bpf_program__set_autoload(obj->progs.fexit__inet_csk_accept, false);
         err = err ?: bpf_program__set_autoload(obj->progs.fexit__tcp_v4_connect, false);