Fix closed chan read 2

pkg/ebpf/bpf_log.go

@@ -192,15 +192,10 @@ func (t *Tracee) processBPFLogs(ctx context.Context) {
 			}
 
 		case lost := <-t.lostBPFLogChannel:
-			// When terminating tracee-ebpf the lost channel receives multiple "0 lost events" events.
-			// This check prevents those 0 lost events messages to be written to stderr until the bug is fixed:
-			// https://github.com/aquasecurity/libbpfgo/issues/122
-			if lost > 0 {
-				if err := t.stats.LostBPFLogsCount.Increment(lost); err != nil {
-					logger.Errorw("Incrementing lost BPF logs count", "error", err)
-				}
-				logger.Warnw(fmt.Sprintf("Lost %d ebpf logs events", lost))
+			if err := t.stats.LostBPFLogsCount.Increment(lost); err != nil {
+				logger.Errorw("Incrementing lost BPF logs count", "error", err)
 			}
+			logger.Warnw(fmt.Sprintf("Lost %d ebpf logs events", lost))
 
 		case <-ctx.Done():
 			return

pkg/ebpf/capture.go

@@ -214,15 +214,10 @@ func (t *Tracee) processFileCaptures(ctx context.Context) {
 			}
 
 		case lost := <-t.lostCapturesChannel:
-			// When terminating tracee-ebpf the lost channel receives multiple "0 lost events" events.
-			// This check prevents those 0 lost events messages to be written to stderr until the bug is fixed:
-			// https://github.com/aquasecurity/libbpfgo/issues/122
-			if lost > 0 {
-				if err := t.stats.LostWrCount.Increment(lost); err != nil {
-					logger.Errorw("Incrementing lost capture count", "error", err)
-				}
-				logger.Warnw(fmt.Sprintf("Lost %d capture events", lost))
+			if err := t.stats.LostWrCount.Increment(lost); err != nil {
+				logger.Errorw("Incrementing lost capture count", "error", err)
 			}
+			logger.Warnw(fmt.Sprintf("Lost %d capture events", lost))
 
 		case <-ctx.Done():
 			return

pkg/ebpf/events_processor.go

@@ -36,19 +36,22 @@ func (t *Tracee) processLostEvents() {
 	logger.Debugw("Starting processLostEvents goroutine")
 	defer logger.Debugw("Stopped processLostEvents goroutine")
 
+	// Since this is an end-stage goroutine, it should be terminated when:
+	// - lostEvChannel is closed, or finally when;
+	// - internal done channel is closed (not ctx).
 	for {
 		select {
-		case lost := <-t.lostEvChannel:
-			// When terminating tracee-ebpf the lost channel receives multiple "0 lost events" events.
-			// This check prevents those 0 lost events messages to be written to stderr until the bug is fixed:
-			// https://github.com/aquasecurity/libbpfgo/issues/122
-			if lost > 0 {
-				if err := t.stats.LostEvCount.Increment(lost); err != nil {
-					logger.Errorw("Incrementing lost event count", "error", err)
-				}
-				logger.Warnw(fmt.Sprintf("Lost %d events", lost))
+		case lost, ok := <-t.lostEvChannel:
+			if !ok {
+				return // lostEvChannel is closed, lost is zero value
+			}
+
+			if err := t.stats.LostEvCount.Increment(lost); err != nil {
+				logger.Errorw("Incrementing lost event count", "error", err)
 			}
-		// Since this is an end-state goroutine, it should be terminated only when Tracee done channel is closed.
+			logger.Warnw(fmt.Sprintf("Lost %d events", lost))
+
+		// internal done channel is closed when Tracee is stopped via Tracee.Close()
 		case <-t.done:
 			return
 		}

pkg/ebpf/net_capture.go

@@ -62,13 +62,10 @@ func (t *Tracee) processNetCapEvents(ctx context.Context, in <-chan *trace.Event
 				_ = t.stats.NetCapCount.Increment()
 
 			case lost := <-t.lostNetCapChannel:
-				if lost > 0 {
-					// https://github.com/aquasecurity/libbpfgo/issues/122
-					if err := t.stats.LostNtCapCount.Increment(lost); err != nil {
-						logger.Errorw("Incrementing lost network events count", "error", err)
-					}
-					logger.Warnw(fmt.Sprintf("Lost %d network capture events", lost))
+				if err := t.stats.LostNtCapCount.Increment(lost); err != nil {
+					logger.Errorw("Incrementing lost network events count", "error", err)
 				}
+				logger.Warnw(fmt.Sprintf("Lost %d network capture events", lost))
 
 			case <-ctx.Done():
 				return

pkg/ebpf/tracee.go

@@ -1366,16 +1366,16 @@ func (t *Tracee) Run(ctx gocontext.Context) error {
 	t.ready(ctx)          // executes ready callback, non blocking
 	<-ctx.Done()          // block until ctx is cancelled elsewhere
 
-	// Stop perf buffers
+	// Close perf buffers
 
-	t.eventsPerfMap.Stop()
+	t.eventsPerfMap.Close()
 	if t.config.BlobPerfBufferSize > 0 {
-		t.fileWrPerfMap.Stop()
+		t.fileWrPerfMap.Close()
 	}
 	if pcaps.PcapsEnabled(t.config.Capture.Net) {
-		t.netCapPerfMap.Stop()
+		t.netCapPerfMap.Close()
 	}
-	t.bpfLogsPerfMap.Stop()
+	t.bpfLogsPerfMap.Close()
 
 	// TODO: move logic below somewhere else (related to file writes)