diff --git a/pkg/bpf/detect.go b/pkg/bpf/detect.go index 71d22e13402..0a84f35ae06 100644 --- a/pkg/bpf/detect.go +++ b/pkg/bpf/detect.go @@ -422,6 +422,10 @@ func HasMissedStatsKprobeMulti() bool { } func LogFeatures() string { + // once we have detected all features, flush the BTF spec + // we cache all values so calling again a Has* function will + // not load the BTF again + defer ebtf.FlushKernelSpec() return fmt.Sprintf("override_return: %t, buildid: %t, kprobe_multi: %t, uprobe_multi %t, fmodret: %t, fmodret_syscall: %t, signal: %t, large: %t, link_pin: %t, lsm: %t, missed_stats_kprobe_multi: %t, missed_stats_kprobe: %t", HasOverrideHelper(), HasBuildId(), HasKprobeMulti(), HasUprobeMulti(), HasModifyReturn(), HasModifyReturnSyscall(), HasSignalHelper(), HasProgramLargeSize(), diff --git a/pkg/sensors/program/loader.go b/pkg/sensors/program/loader.go index fe95f12280d..81590cac8c7 100644 --- a/pkg/sensors/program/loader.go +++ b/pkg/sensors/program/loader.go @@ -856,6 +856,8 @@ func doLoadProgram( return nil, fmt.Errorf("opening collection '%s' failed: %w", load.Name, err) } defer coll.Close() + // cleanup the BTF once we have loaded the program + defer btf.FlushKernelSpec() err = installTailCalls(bpfDir, spec, coll, load) if err != nil { @@ -911,6 +913,11 @@ func doLoadProgram( load.Prog = prog + // in KernelTypes, we use a non-standard BTF which is possibly annotated with symbols + // from kernel modules. At this point wewe don't need that anymore, so we can release + // the memory from it. + load.KernelTypes = nil + // Copy the loaded collection before it's destroyed if KeepCollection { return copyLoadedCollection(coll)