github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-07 09:13:57 +00:00
Code Issues Projects Releases Wiki Activity

fix(userspace/falco): when counting -M timeout, make sure that time diff is > 0.

Browse Source 
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
This commit is contained in:
Federico Di Pierro 2025-02-26 16:32:36 +01:00 committed by poiana
parent 79bed43862
commit 9cbfdda21f
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
userspace/falco/app/actions/process_events.cpp
View File

@ -260,10 +260,18 @@ static falco::app::run_result do_inspect(
// Reset the timeouts counter, Falco successfully got an event to process // Reset the timeouts counter, Falco successfully got an event to process
timeouts_since_last_success_or_msg = 0; timeouts_since_last_success_or_msg = 0;
if(duration_start == 0) { if(duration_start == 0) {
duration_start = ev->get_ts(); duration_start = ev->get_ts();
} else if(duration_to_tot_ns > 0) { } else if(duration_to_tot_ns > 0) {
if(ev->get_ts() - duration_start >= duration_to_tot_ns) { // Highest priority async events (whose timestamp is -1 and get set by sinsp to current
// ts) are processed **before** other events, event if already enqueued. This means that
// we might find ourself in a situation where we have duration_start whose ts is > then
// next ev->get_ts(), leading t ev->get_ts() - duration_start being <0 (and, since we
// are unsigned here, huge). The diff should never need to be that large anyway, use a
// signed.
const int64_t diff = ev->get_ts() - duration_start;
if(diff >= (int64_t)duration_to_tot_ns) {
break; break;
} }
} }