diff --git a/pkg/bpf/detect.go b/pkg/bpf/detect.go index 71d22e13402..0a84f35ae06 100644 --- a/pkg/bpf/detect.go +++ b/pkg/bpf/detect.go @@ -422,6 +422,10 @@ func HasMissedStatsKprobeMulti() bool { } func LogFeatures() string { + // once we have detected all features, flush the BTF spec + // we cache all values so calling again a Has* function will + // not load the BTF again + defer ebtf.FlushKernelSpec() return fmt.Sprintf("override_return: %t, buildid: %t, kprobe_multi: %t, uprobe_multi %t, fmodret: %t, fmodret_syscall: %t, signal: %t, large: %t, link_pin: %t, lsm: %t, missed_stats_kprobe_multi: %t, missed_stats_kprobe: %t", HasOverrideHelper(), HasBuildId(), HasKprobeMulti(), HasUprobeMulti(), HasModifyReturn(), HasModifyReturnSyscall(), HasSignalHelper(), HasProgramLargeSize(), diff --git a/pkg/sensors/load.go b/pkg/sensors/load.go index 69bdf6105c8..aef51289d47 100644 --- a/pkg/sensors/load.go +++ b/pkg/sensors/load.go @@ -11,6 +11,7 @@ import ( "strings" "github.com/cilium/ebpf" + "github.com/cilium/ebpf/btf" cachedbtf "github.com/cilium/tetragon/pkg/btf" "github.com/cilium/tetragon/pkg/kernels" "github.com/cilium/tetragon/pkg/logger" @@ -124,6 +125,9 @@ func (s *Sensor) Load(bpfDir string) error { progsAdd(s.Progs) AllMaps = append(AllMaps, s.Maps...) + // cleanup the BTF once we have loaded all sensor's program + btf.FlushKernelSpec() + l.WithField("sensor", s.Name).Infof("Loaded BPF maps and events for sensor successfully") s.Loaded = true return nil diff --git a/pkg/sensors/program/loader.go b/pkg/sensors/program/loader.go index fe95f12280d..d849d65bf28 100644 --- a/pkg/sensors/program/loader.go +++ b/pkg/sensors/program/loader.go @@ -911,6 +911,11 @@ func doLoadProgram( load.Prog = prog + // in KernelTypes, we use a non-standard BTF which is possibly annotated with symbols + // from kernel modules. At this point we don't need that anymore, so we can release + // the memory from it. + load.KernelTypes = nil + // Copy the loaded collection before it's destroyed if KeepCollection { return copyLoadedCollection(coll)