From edadabc84752f16c84129504785e500414802afc Mon Sep 17 00:00:00 2001 From: Jiri Olsa Date: Thu, 23 Apr 2026 16:45:26 +0200 Subject: [PATCH 1/7] tetragon: Use longest failed chain for last error in BTF resolve [ upstream commit 017ff05a4dd6ae980e08a22e530c3cca88509e48 ] Currently we break the resolve loop earlier than it's needed, which might cause premature end of the resolve scan, let's remove that. Let's instead store the last error based on the largest resolved depth and use this error as the final one in case of error. Signed-off-by: Jiri Olsa Signed-off-by: Kornilios Kourtis --- pkg/btf/btf.go | 28 +++++++++++++++++++--------- 1 file changed, 19 insertions(+), 9 deletions(-) diff --git a/pkg/btf/btf.go b/pkg/btf/btf.go index 6996ee21f97..bd527c5a3dd 100644 --- a/pkg/btf/btf.go +++ b/pkg/btf/btf.go @@ -6,6 +6,7 @@ package btf import ( + "errors" "fmt" "math" "os" @@ -301,6 +302,15 @@ func ResolveBTFPath( } } +type resolveError struct { + idx int + str string +} + +func (e *resolveError) Error() string { + return e.str +} + func processMembers( btfArgs *[api.MaxBTFArgDepth]api.ConfigBTFArg, currentType btf.Type, @@ -308,7 +318,7 @@ func processMembers( pathToFound []string, i int, ) (*btf.Type, error) { - var lastError error + var lastError *resolveError memberWasFound := false for _, member := range members { if len(member.Name) == 0 { // If anonymous struct, fallthrough @@ -316,14 +326,14 @@ func processMembers( btfArgs[i].IsInitialized = uint16(1) lastTy, err := ResolveBTFPath(btfArgs, ResolveNestedTypes(member.Type), pathToFound, i) if err != nil { - if lastError != nil { - idx := i + 1 - // If the error raised originates from a depth greater than the current one, we stop the search. - if idx < len(pathToFound) && strings.Contains(lastError.Error(), pathToFound[idx]) { - break + // Propagate the deepest error for both resolve and non-resolve error. + if err2, ok := errors.AsType[*resolveError](err); ok { + if lastError == nil || lastError.idx < err2.idx { + lastError = err2 } + } else if lastError == nil || lastError.idx <= i { + lastError = &resolveError{i, err.Error()} } - lastError = err continue } return lastTy, nil @@ -344,12 +354,12 @@ func processMembers( if lastError != nil { return nil, lastError } - return nil, fmt.Errorf( + return nil, &resolveError{i, fmt.Sprintf( "attribute %q not found in structure %q found %v", pathToFound[i], currentType.TypeName(), members, - ) + )} } switch t := currentType.(type) { case *btf.Pointer: From d4b02557c889d40c99fefb98810b58c38f5c4146 Mon Sep 17 00:00:00 2001 From: Jiri Olsa Date: Thu, 23 Apr 2026 22:13:54 +0200 Subject: [PATCH 2/7] tetragon: Call ResolveNestedTypes directly in affected functions [ upstream commit 4a45a9c64938c73b4c7aa95cf4bb6587a938bde6 ] To simplify the code a bit before following changes. Signed-off-by: Jiri Olsa Signed-off-by: Kornilios Kourtis --- pkg/btf/btf.go | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/pkg/btf/btf.go b/pkg/btf/btf.go index bd527c5a3dd..05b09df1493 100644 --- a/pkg/btf/btf.go +++ b/pkg/btf/btf.go @@ -263,6 +263,7 @@ func ResolveBTFPath( pathToFound []string, i int, ) (*btf.Type, error) { + currentType = ResolveNestedTypes(currentType) switch t := currentType.(type) { case *btf.Struct: return processMembers(btfArgs, currentType, t.Members, pathToFound, i) @@ -277,9 +278,9 @@ func ResolveBTFPath( if idx, err := parseArrayIdxStr(pathToFound[i]); err == nil { // To stay ahead on the dereferecing, we mark the current btfArg as pointer btfArgs[i].IsPointer = uint16(1) - return processArray(btfArgs, ResolveNestedTypes(t.Target), pathToFound, i, idx) + return processArray(btfArgs, t.Target, pathToFound, i, idx) } - return ResolveBTFPath(btfArgs, ResolveNestedTypes(t.Target), pathToFound, i) + return ResolveBTFPath(btfArgs, t.Target, pathToFound, i) case *btf.Array: idx, err := parseArrayIdxStr(pathToFound[i]) if err != nil { @@ -288,7 +289,7 @@ func ResolveBTFPath( if idx >= t.Nelems { return nil, fmt.Errorf("array index out of bound. Nelems=%d, got=%d", t.Nelems, idx) } - return processArray(btfArgs, ResolveNestedTypes(t.Type), pathToFound, i, idx) + return processArray(btfArgs, t.Type, pathToFound, i, idx) default: ty := currentType.TypeName() if len(ty) == 0 { @@ -324,7 +325,7 @@ func processMembers( if len(member.Name) == 0 { // If anonymous struct, fallthrough btfArgs[i].Offset = member.Offset.Bytes() btfArgs[i].IsInitialized = uint16(1) - lastTy, err := ResolveBTFPath(btfArgs, ResolveNestedTypes(member.Type), pathToFound, i) + lastTy, err := ResolveBTFPath(btfArgs, member.Type, pathToFound, i) if err != nil { // Propagate the deepest error for both resolve and non-resolve error. if err2, ok := errors.AsType[*resolveError](err); ok { @@ -344,7 +345,7 @@ func processMembers( btfArgs[i].IsInitialized = uint16(1) isNotLastChild := i < len(pathToFound)-1 && i < api.MaxBTFArgDepth if isNotLastChild { - return ResolveBTFPath(btfArgs, ResolveNestedTypes(member.Type), pathToFound, i+1) + return ResolveBTFPath(btfArgs, member.Type, pathToFound, i+1) } currentType = ResolveNestedTypes(member.Type) break @@ -378,6 +379,7 @@ func processArray( i int, idx uint32, ) (*btf.Type, error) { + targetType = ResolveNestedTypes(targetType) btfArgs[i].IsInitialized = uint16(1) btfArgs[i].Offset = getSizeofType(targetType) * idx if len(pathToFound) > i+1 { From 1ea7f7d9f1362ca7965e830e032d46db04f9f5c7 Mon Sep 17 00:00:00 2001 From: Jiri Olsa Date: Thu, 23 Apr 2026 22:01:49 +0200 Subject: [PATCH 3/7] tetragon: Factor processMembers code [ upstream commit bca819feb6f9cb7dae66f9277cc820ede4494899 ] Keeping the functionality and hoping to make it bit simpler. Signed-off-by: Jiri Olsa Signed-off-by: Kornilios Kourtis --- pkg/btf/btf.go | 54 +++++++++++++++++++++----------------------------- 1 file changed, 23 insertions(+), 31 deletions(-) diff --git a/pkg/btf/btf.go b/pkg/btf/btf.go index 05b09df1493..83efa0d325c 100644 --- a/pkg/btf/btf.go +++ b/pkg/btf/btf.go @@ -320,11 +320,8 @@ func processMembers( i int, ) (*btf.Type, error) { var lastError *resolveError - memberWasFound := false for _, member := range members { - if len(member.Name) == 0 { // If anonymous struct, fallthrough - btfArgs[i].Offset = member.Offset.Bytes() - btfArgs[i].IsInitialized = uint16(1) + if len(member.Name) == 0 { // anonymous struct/union, fallthrough lastTy, err := ResolveBTFPath(btfArgs, member.Type, pathToFound, i) if err != nil { // Propagate the deepest error for both resolve and non-resolve error. @@ -339,37 +336,32 @@ func processMembers( } return lastTy, nil } - if member.Name == pathToFound[i] { - memberWasFound = true - btfArgs[i].Offset = member.Offset.Bytes() - btfArgs[i].IsInitialized = uint16(1) - isNotLastChild := i < len(pathToFound)-1 && i < api.MaxBTFArgDepth - if isNotLastChild { - return ResolveBTFPath(btfArgs, member.Type, pathToFound, i+1) - } - currentType = ResolveNestedTypes(member.Type) - break + if member.Name != pathToFound[i] { + continue } - } - if !memberWasFound { - if lastError != nil { - return nil, lastError + btfArgs[i].Offset = member.Offset.Bytes() + btfArgs[i].IsInitialized = uint16(1) + if i < len(pathToFound)-1 && i < api.MaxBTFArgDepth { + return ResolveBTFPath(btfArgs, member.Type, pathToFound, i+1) + } + memberType := ResolveNestedTypes(member.Type) + switch t := memberType.(type) { + case *btf.Pointer: + btfArgs[i].IsPointer = uint16(1) + memberType = t.Target + case *btf.Int, *btf.Enum: + btfArgs[i].IsPointer = uint16(1) } - return nil, &resolveError{i, fmt.Sprintf( - "attribute %q not found in structure %q found %v", - pathToFound[i], - currentType.TypeName(), - members, - )} + return &memberType, nil } - switch t := currentType.(type) { - case *btf.Pointer: - btfArgs[i].IsPointer = uint16(1) - currentType = t.Target - case *btf.Int, *btf.Enum: - btfArgs[i].IsPointer = uint16(1) + if lastError != nil { + return nil, lastError } - return ¤tType, nil + return nil, &resolveError{i, fmt.Sprintf( + "attribute %q not found in structure %q", + pathToFound[i], + currentType.TypeName(), + )} } func processArray( From 376ce96cb1c4598d332ba89dee54e3492d4bba4e Mon Sep 17 00:00:00 2001 From: Jiri Olsa Date: Mon, 27 Apr 2026 16:55:25 +0000 Subject: [PATCH 4/7] tetragon: Add test for btf resolve errors [ upstream commit f68822949222d0e28c0b80fcb0413988c6d9b6b8 ] Making sure we get expected errors from ResolveBTFPath. Signed-off-by: Jiri Olsa Signed-off-by: Kornilios Kourtis --- pkg/btf/btf_test.go | 156 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 156 insertions(+) diff --git a/pkg/btf/btf_test.go b/pkg/btf/btf_test.go index a2694bbdf67..2ecb279d573 100644 --- a/pkg/btf/btf_test.go +++ b/pkg/btf/btf_test.go @@ -680,3 +680,159 @@ func TestParseArrayIdxStr(t *testing.T) { }) } } + +func TestProcessMembersErrorPrecedence(t *testing.T) { + intTy := &btf.Int{Name: "int", Size: 4} + + // deeper resolveError beats shallower resolveError + t.Run("deepest_resolve_error_wins", func(t *testing.T) { + // struct outer { + // struct { int a; }; // anon1: "x" not found → resolveError{depth=0} + // struct { struct inner { int b; } x; }; // anon2: "x" found, "y" not found → resolveError{depth=1} + // }; + inner := &btf.Struct{ + Name: "inner", + Size: 4, + Members: []btf.Member{ + {Name: "b", Type: intTy, Offset: 0}, + }, + } + anon1 := &btf.Struct{ + Size: 4, + Members: []btf.Member{ + {Name: "a", Type: intTy, Offset: 0}, + }, + } + anon2 := &btf.Struct{ + Size: 4, + Members: []btf.Member{ + {Name: "x", Type: inner, Offset: 0}, + }, + } + outer := &btf.Struct{ + Name: "outer", + Size: 8, + Members: []btf.Member{ + {Name: "", Type: anon1, Offset: 0}, + {Name: "", Type: anon2, Offset: btf.Bits(32)}, + }, + } + + var btfArgs [api.MaxBTFArgDepth]api.ConfigBTFArg + _, err := ResolveBTFPath(&btfArgs, outer, []string{"x", "y"}, 0) + require.Error(t, err) + assert.ErrorContains(t, err, `attribute "y" not found in structure "inner"`) + }) + + // non-resolveError (attribute found, wrong type) beats resolveError at the same depth + t.Run("non_resolve_error_beats_resolve_error_at_same_depth", func(t *testing.T) { + // struct outer { + // struct { int q; }; // anon1: "x" not found → resolveError{depth=0} + // struct { int x; }; // anon2: "x" found, int has no subfields → "unexpected type" (non-resolveError at depth=0) + // }; + // + // anon2 got further (found "x"), so its error should win + anon1 := &btf.Struct{ + Size: 4, + Members: []btf.Member{ + {Name: "q", Type: intTy, Offset: 0}, + }, + } + anon2 := &btf.Struct{ + Size: 4, + Members: []btf.Member{ + {Name: "x", Type: intTy, Offset: 0}, + }, + } + outer := &btf.Struct{ + Name: "outer", + Size: 8, + Members: []btf.Member{ + {Name: "", Type: anon1, Offset: 0}, + {Name: "", Type: anon2, Offset: btf.Bits(32)}, + }, + } + + var btfArgs [api.MaxBTFArgDepth]api.ConfigBTFArg + // Two-element path: "x" is not the last child, so finding it in anon2 triggers + // ResolveBTFPath(int, path, 1) which returns a non-resolveError. + _, err := ResolveBTFPath(&btfArgs, outer, []string{"x", "y"}, 0) + require.Error(t, err) + assert.ErrorContains(t, err, `unexpected type : "x" has type "int"`) + }) + + // deeper resolveError from a later branch beats a non-resolveError from an earlier branch + t.Run("deep_resolve_error_beats_non_resolve_error", func(t *testing.T) { + // struct outer { + // struct { int x; }; // anon1: "x" found, int type → non-resolveError stored at depth=0 + // struct { struct inner { int b; } x; }; // anon2: "x" found, "y" not in inner → resolveError{depth=1} + // }; + // + // anon2's resolveError at depth 1 is deeper than anon1's non-resolveError at depth 0. + inner := &btf.Struct{ + Name: "inner", + Size: 4, + Members: []btf.Member{ + {Name: "b", Type: intTy, Offset: 0}, + }, + } + anon1 := &btf.Struct{ + Size: 4, + Members: []btf.Member{ + {Name: "x", Type: intTy, Offset: 0}, + }, + } + anon2 := &btf.Struct{ + Size: 4, + Members: []btf.Member{ + {Name: "x", Type: inner, Offset: 0}, + }, + } + outer := &btf.Struct{ + Name: "outer", + Size: 8, + Members: []btf.Member{ + {Name: "", Type: anon1, Offset: 0}, + {Name: "", Type: anon2, Offset: btf.Bits(32)}, + }, + } + + var btfArgs [api.MaxBTFArgDepth]api.ConfigBTFArg + _, err := ResolveBTFPath(&btfArgs, outer, []string{"x", "y"}, 0) + require.Error(t, err) + assert.ErrorContains(t, err, `attribute "y" not found in structure "inner"`) + }) + + // success through one anonymous branch when another fails + t.Run("success_through_anonymous_branch", func(t *testing.T) { + // struct outer { + // struct { int q; }; // anon1: "x" not found, int type + // struct { int x; }; // anon2: "x" found + // }; + anon1 := &btf.Struct{ + Size: 4, + Members: []btf.Member{ + {Name: "q", Type: intTy, Offset: 0}, + }, + } + anon2 := &btf.Struct{ + Size: 4, + Members: []btf.Member{ + {Name: "x", Type: intTy, Offset: 0}, + }, + } + outer := &btf.Struct{ + Name: "outer", + Size: 8, + Members: []btf.Member{ + {Name: "", Type: anon1, Offset: 0}, + {Name: "", Type: anon2, Offset: btf.Bits(32)}, + }, + } + + var btfArgs [api.MaxBTFArgDepth]api.ConfigBTFArg + ty, err := ResolveBTFPath(&btfArgs, outer, []string{"x"}, 0) + require.NoError(t, err) + require.NotNil(t, ty) + }) +} From dbd3a6c4e15f3aa8834a192292210db3a83169ab Mon Sep 17 00:00:00 2001 From: Tristan d'Audibert Date: Fri, 8 May 2026 17:26:33 +0200 Subject: [PATCH 5/7] btf : Add accumulator when going up the resolve entries [ upstream commit 54268ba14bb4976d6b400b0316beff3085a47d6e ] When unstacking a nested BTF union or anonymous struct, we fail to store the position of the union/struct itself, only capturing the final element. This leads to incorrect offset resolution. To fix this, we introduce an accumulator mechanism that accumulates the union/anonymous struct offset only when the member.name matches the expected attribute. Signed-off-by: Tristan d'Audibert Signed-off-by: Kornilios Kourtis --- pkg/btf/btf.go | 1 + 1 file changed, 1 insertion(+) diff --git a/pkg/btf/btf.go b/pkg/btf/btf.go index 83efa0d325c..def1814e529 100644 --- a/pkg/btf/btf.go +++ b/pkg/btf/btf.go @@ -334,6 +334,7 @@ func processMembers( } continue } + btfArgs[i].Offset += member.Offset.Bytes() return lastTy, nil } if member.Name != pathToFound[i] { From 10362a94156888ec52344c44e7b77d06d2a5d758 Mon Sep 17 00:00:00 2001 From: Tristan d'Audibert Date: Fri, 8 May 2026 17:34:13 +0200 Subject: [PATCH 6/7] btf_test.go : Fix Union resolution test [ upstream commit 531dfe372af75faed2a562be08f59802fd0011a5 ] Attribute resolution for unions/anonymous struct has been broken since the Resolve algorithm's introduction. This commit aligns with the new logic by implementing the same accumulator mechanism, ensuring identical return values. Signed-off-by: Tristan d'Audibert Signed-off-by: Kornilios Kourtis --- pkg/btf/btf_test.go | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/pkg/btf/btf_test.go b/pkg/btf/btf_test.go index 2ecb279d573..7ab370f19c0 100644 --- a/pkg/btf/btf_test.go +++ b/pkg/btf/btf_test.go @@ -290,29 +290,29 @@ func getBTFPointer(ty btf.Type) (*btf.Pointer, error) { return nil, fmt.Errorf("Invalid type for \"%v\", expected \"*btf.Pointer\", got %q", t, reflect.TypeOf(ty).String()) } -func findMemberInBTFStruct(structTy *btf.Struct, memberName string) (*btf.Member, error) { +func findMemberInBTFStruct(structTy *btf.Struct, memberName string) (*btf.Member, uint32, error) { for _, member := range structTy.Members { if member.Name == memberName { - return &member, nil + return &member, 0, nil } if anonymousStructTy, ok := member.Type.(*btf.Struct); ok && len(member.Name) == 0 { for _, m := range anonymousStructTy.Members { if m.Name == memberName { - return &m, nil + return &m, uint32(member.Offset.Bytes()), nil } } } - if unionTy, ok := member.Type.(*btf.Union); ok { + if unionTy, ok := member.Type.(*btf.Union); ok && len(member.Name) == 0 { for _, m := range unionTy.Members { if m.Name == memberName { - return &m, nil + return &m, uint32(member.Offset.Bytes()), nil } } } } - return nil, fmt.Errorf("Member %q not found in struct %v", memberName, structTy) + return nil, 0, fmt.Errorf("Member %q not found in struct %v", memberName, structTy) } func getBTFPointerAndSetConfig(ty btf.Type, btfConfig *api.ConfigBTFArg) (*btf.Pointer, error) { @@ -329,12 +329,12 @@ func getBTFPointerAndSetConfig(ty btf.Type, btfConfig *api.ConfigBTFArg) (*btf.P func getConfigAndNextType(structTy *btf.Struct, memberName string) (*btf.Type, *api.ConfigBTFArg, error) { btfConfig := api.ConfigBTFArg{} - member, err := findMemberInBTFStruct(structTy, memberName) + member, parentOffset, err := findMemberInBTFStruct(structTy, memberName) if err != nil { return nil, nil, err } - btfConfig.Offset = uint32(member.Offset.Bytes()) + btfConfig.Offset = uint32(member.Offset.Bytes()) + parentOffset btfConfig.IsInitialized = uint16(1) ty := ResolveNestedTypes(member.Type) @@ -352,12 +352,12 @@ func getConfigAndNextType(structTy *btf.Struct, memberName string) (*btf.Type, * func getConfigAndNextStruct(structTy *btf.Struct, memberName string) (*btf.Struct, *api.ConfigBTFArg, error) { btfConfig := api.ConfigBTFArg{} - member, err := findMemberInBTFStruct(structTy, memberName) + member, parentOffset, err := findMemberInBTFStruct(structTy, memberName) if err != nil { return nil, nil, err } - btfConfig.Offset = uint32(member.Offset.Bytes()) + btfConfig.Offset = uint32(member.Offset.Bytes()) + parentOffset btfConfig.IsInitialized = uint16(1) ty := ResolveNestedTypes(member.Type) From 7725b60c08a7ce7e3cb2e05859cf5029bdf58c17 Mon Sep 17 00:00:00 2001 From: Andy Strohman Date: Sat, 9 May 2026 19:55:49 +0000 Subject: [PATCH 7/7] tracing: improve arg read error status message [ upstream commit 91de8f42e80119b6d314f27224be65f218c600db ] Improve the messages so that the error is more understandable. Basic types are types that we support without resolve or are the terminal type when doing resolve. They are the types that users specify as an arg's type within the policy. For dereference issues that happen during resolve, we report the depth, or the index of the resolve configuration where the dereference failed. This change subtracts one from the status value that is reported from the bpf program because status 0 signifies the non-error case. Signed-off-by: Andy Strohman Signed-off-by: Kornilios Kourtis --- pkg/sensors/tracing/args_linux.go | 4 ++-- pkg/sensors/tracing/uprobe_reg_test.go | 22 +++++++++++----------- pkg/sensors/tracing/uprobe_test.go | 2 +- tests/policytests/kprobes.go | 2 +- 4 files changed, 15 insertions(+), 15 deletions(-) diff --git a/pkg/sensors/tracing/args_linux.go b/pkg/sensors/tracing/args_linux.go index 2eff6ffa267..1e7370be228 100644 --- a/pkg/sensors/tracing/args_linux.go +++ b/pkg/sensors/tracing/args_linux.go @@ -134,9 +134,9 @@ func getArgStatus(r *bytes.Reader) (*api.MsgGenericKprobeArgError, error) { if status != 0 { if status == ^uint32(0) { - arg.Message = "Bad address" + arg.Message = "Bad address for basic type" } else { - arg.Message = strconv.FormatUint(uint64(status), 10) + arg.Message = "Bad address encountered during resolve dereference at depth " + strconv.FormatUint(uint64(status-1), 10) } return &arg, nil } diff --git a/pkg/sensors/tracing/uprobe_reg_test.go b/pkg/sensors/tracing/uprobe_reg_test.go index 3795daf94b6..6a851038fdc 100644 --- a/pkg/sensors/tracing/uprobe_reg_test.go +++ b/pkg/sensors/tracing/uprobe_reg_test.go @@ -202,35 +202,35 @@ func TestUprobeResolve(t *testing.T) { ec.NewKprobeArgumentChecker().WithSizeArg(10), // uint64(10) ec.NewKprobeArgumentChecker().WithUintArg(0), ec.NewKprobeArgumentChecker().WithUintArg(0), - ec.NewKprobeArgumentChecker().WithErrorArg(ec.NewKprobeErrorChecker().WithMessage(sm.Full("3"))), - ec.NewKprobeArgumentChecker().WithErrorArg(ec.NewKprobeErrorChecker().WithMessage(sm.Full("2"))), + ec.NewKprobeArgumentChecker().WithErrorArg(ec.NewKprobeErrorChecker().WithMessage(sm.Full("Bad address encountered during resolve dereference at depth 2"))), + ec.NewKprobeArgumentChecker().WithErrorArg(ec.NewKprobeErrorChecker().WithMessage(sm.Full("Bad address encountered during resolve dereference at depth 1"))), }}, {"uint32", 1234, "enum_u32", []*ec.KprobeArgumentChecker{ ec.NewKprobeArgumentChecker().WithSizeArg(0), ec.NewKprobeArgumentChecker().WithUintArg(1234), // uint32(1234) ec.NewKprobeArgumentChecker().WithUintArg(0), - ec.NewKprobeArgumentChecker().WithErrorArg(ec.NewKprobeErrorChecker().WithMessage(sm.Full("3"))), - ec.NewKprobeArgumentChecker().WithErrorArg(ec.NewKprobeErrorChecker().WithMessage(sm.Full("2"))), + ec.NewKprobeArgumentChecker().WithErrorArg(ec.NewKprobeErrorChecker().WithMessage(sm.Full("Bad address encountered during resolve dereference at depth 2"))), + ec.NewKprobeArgumentChecker().WithErrorArg(ec.NewKprobeErrorChecker().WithMessage(sm.Full("Bad address encountered during resolve dereference at depth 1"))), }}, {"uint32", 12, "sub.v32", []*ec.KprobeArgumentChecker{ ec.NewKprobeArgumentChecker().WithSizeArg(0), ec.NewKprobeArgumentChecker().WithUintArg(0), ec.NewKprobeArgumentChecker().WithUintArg(12), // uint32(12) - ec.NewKprobeArgumentChecker().WithErrorArg(ec.NewKprobeErrorChecker().WithMessage(sm.Full("3"))), - ec.NewKprobeArgumentChecker().WithErrorArg(ec.NewKprobeErrorChecker().WithMessage(sm.Full("2"))), + ec.NewKprobeArgumentChecker().WithErrorArg(ec.NewKprobeErrorChecker().WithMessage(sm.Full("Bad address encountered during resolve dereference at depth 2"))), + ec.NewKprobeArgumentChecker().WithErrorArg(ec.NewKprobeErrorChecker().WithMessage(sm.Full("Bad address encountered during resolve dereference at depth 1"))), }}, {"uint64", 13, "arr[2].v64", []*ec.KprobeArgumentChecker{ ec.NewKprobeArgumentChecker().WithSizeArg(0), ec.NewKprobeArgumentChecker().WithUintArg(0), ec.NewKprobeArgumentChecker().WithUintArg(0), ec.NewKprobeArgumentChecker().WithSizeArg(13), // uint64(13) - ec.NewKprobeArgumentChecker().WithErrorArg(ec.NewKprobeErrorChecker().WithMessage(sm.Full("3"))), + ec.NewKprobeArgumentChecker().WithErrorArg(ec.NewKprobeErrorChecker().WithMessage(sm.Full("Bad address encountered during resolve dereference at depth 2"))), }}, {"uint64", 14, "dyn[6].v64", []*ec.KprobeArgumentChecker{ ec.NewKprobeArgumentChecker().WithSizeArg(0), ec.NewKprobeArgumentChecker().WithUintArg(0), ec.NewKprobeArgumentChecker().WithUintArg(0), - ec.NewKprobeArgumentChecker().WithErrorArg(ec.NewKprobeErrorChecker().WithMessage(sm.Full("3"))), + ec.NewKprobeArgumentChecker().WithErrorArg(ec.NewKprobeErrorChecker().WithMessage(sm.Full("Bad address encountered during resolve dereference at depth 2"))), ec.NewKprobeArgumentChecker().WithSizeArg(14), // uint64(14) }}, } @@ -1336,13 +1336,13 @@ func TestUprobeResolveNull(t *testing.T) { kpArgs []*ec.KprobeArgumentChecker }{ {"first", []*ec.KprobeArgumentChecker{ - ec.NewKprobeArgumentChecker().WithErrorArg(ec.NewKprobeErrorChecker().WithMessage(sm.Full("1"))), + ec.NewKprobeArgumentChecker().WithErrorArg(ec.NewKprobeErrorChecker().WithMessage(sm.Full("Bad address encountered during resolve dereference at depth 0"))), }}, {"second", []*ec.KprobeArgumentChecker{ - ec.NewKprobeArgumentChecker().WithErrorArg(ec.NewKprobeErrorChecker().WithMessage(sm.Full("2"))), + ec.NewKprobeArgumentChecker().WithErrorArg(ec.NewKprobeErrorChecker().WithMessage(sm.Full("Bad address encountered during resolve dereference at depth 1"))), }}, {"third", []*ec.KprobeArgumentChecker{ - ec.NewKprobeArgumentChecker().WithErrorArg(ec.NewKprobeErrorChecker().WithMessage(sm.Full("3"))), + ec.NewKprobeArgumentChecker().WithErrorArg(ec.NewKprobeErrorChecker().WithMessage(sm.Full("Bad address encountered during resolve dereference at depth 2"))), }}, {"nonull", []*ec.KprobeArgumentChecker{ ec.NewKprobeArgumentChecker().WithIntArg(0), diff --git a/pkg/sensors/tracing/uprobe_test.go b/pkg/sensors/tracing/uprobe_test.go index cc150e98a00..c0414b8b104 100644 --- a/pkg/sensors/tracing/uprobe_test.go +++ b/pkg/sensors/tracing/uprobe_test.go @@ -1254,7 +1254,7 @@ spec: WithBinary(sm.Full(uprobeTest1))).WithSymbol(sm.Full("uprobe_test_lib_string_arg_null")).WithArgs(ec.NewKprobeArgumentListMatcher(). WithOperator(lc.Ordered). WithValues( - ec.NewKprobeArgumentChecker().WithErrorArg(ec.NewKprobeErrorChecker().WithMessage(sm.Full("Bad address"))), + ec.NewKprobeArgumentChecker().WithErrorArg(ec.NewKprobeErrorChecker().WithMessage(sm.Full("Bad address for basic type"))), ec.NewKprobeArgumentChecker().WithIntArg(0)), ) checker := ec.NewUnorderedEventChecker(upChecker) diff --git a/tests/policytests/kprobes.go b/tests/policytests/kprobes.go index 78675703e85..4a5759e7d37 100644 --- a/tests/policytests/kprobes.go +++ b/tests/policytests/kprobes.go @@ -70,7 +70,7 @@ spec: WithBinary(sm.Full(myBin))).WithArgs(ec.NewKprobeArgumentListMatcher(). WithOperator(lc.Ordered). WithValues( - ec.NewKprobeArgumentChecker().WithErrorArg(ec.NewKprobeErrorChecker().WithMessage(sm.Full("Bad address"))), + ec.NewKprobeArgumentChecker().WithErrorArg(ec.NewKprobeErrorChecker().WithMessage(sm.Full("Bad address for basic type"))), )).WithReturn(ec.NewKprobeArgumentChecker().WithIntArg(0)) return &policytest.Scenario{