[btf] Flush kernel spec (BTF) after loading programs

Do not cache BTF. Reload it when needed.

Signed-off-by: Anastasios Papagiannis <[email protected]>

pkg/bpf/detect.go

@@ -422,6 +422,10 @@ func HasMissedStatsKprobeMulti() bool {
 }
 
 func LogFeatures() string {
+	// once we have detected all features, flush the BTF spec
+	// we cache all values so calling again a Has* function will
+	// not load the BTF again
+	defer ebtf.FlushKernelSpec()
 	return fmt.Sprintf("override_return: %t, buildid: %t, kprobe_multi: %t, uprobe_multi %t, fmodret: %t, fmodret_syscall: %t, signal: %t, large: %t, link_pin: %t, lsm: %t, missed_stats_kprobe_multi: %t, missed_stats_kprobe: %t",
 		HasOverrideHelper(), HasBuildId(), HasKprobeMulti(), HasUprobeMulti(),
 		HasModifyReturn(), HasModifyReturnSyscall(), HasSignalHelper(), HasProgramLargeSize(),

pkg/sensors/program/loader.go

@@ -856,6 +856,8 @@ func doLoadProgram(
 		return nil, fmt.Errorf("opening collection '%s' failed: %w", load.Name, err)
 	}
 	defer coll.Close()
+	// cleanup the BTF once we have loaded the program
+	defer btf.FlushKernelSpec()
 
 	err = installTailCalls(bpfDir, spec, coll, load)
 	if err != nil {
@@ -911,6 +913,11 @@ func doLoadProgram(
 
 	load.Prog = prog
 
+	// in KernelTypes, we use a non-standard BTF which is possibly annotated with symbols
+	// from kernel modules. At this point wewe don't need that anymore, so we can release
+	// the memory from it.
+	load.KernelTypes = nil
+
 	// Copy the loaded collection before it's destroyed
 	if KeepCollection {
 		return copyLoadedCollection(coll)