work around gobpf memory leak

ronaudinho · May 18, 2020 · 5dc755f · 5dc755f
1 parent 2187ecb
commit 5dc755f
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/tracee/tracee.go b/tracee/tracee.go
@@ -230,22 +230,23 @@ func (t *Tracee) initBPF(ebpfProgram string) error {
 		}
 	}
 
+	sysPrefix := bpf.GetSyscallPrefix()
 	for _, e := range eventsToTraceFinal {
 		eName := EventsIDToName[e]
 		if IsEventSyscall(e) {
 			kp, err := t.bpfModule.LoadKprobe(fmt.Sprintf("syscall__%s", eName))
 			if err != nil {
 				return fmt.Errorf("error loading kprobe %s: %v", eName, err)
 			}
-			err = t.bpfModule.AttachKprobe(bpf.GetSyscallFnName(eName), kp, -1)
+			err = t.bpfModule.AttachKprobe(sysPrefix+eName, kp, -1)
 			if err != nil {
 				return fmt.Errorf("error attaching kprobe %s: %v", eName, err)
 			}
 			kp, err = t.bpfModule.LoadKprobe(fmt.Sprintf("trace_ret_%s", eName))
 			if err != nil {
 				return fmt.Errorf("error loading kprobe %s: %v", eName, err)
 			}
-			err = t.bpfModule.AttachKretprobe(bpf.GetSyscallFnName(eName), kp, -1)
+			err = t.bpfModule.AttachKretprobe(sysPrefix+eName, kp, -1)
 			if err != nil {
 				return fmt.Errorf("error attaching kretprobe %s: %v", eName, err)
 			}