feat(memtrack): detect and abort on ring buffer overflow

Add a single-slot BPF array that bpf_ringbuf_reserve() failures
atomically increment. Userspace reads it after the run completes and
bails with a guidance message if any events were dropped, since a
truncated trace would silently misreport memory usage.

Author: not-matthias

crates/memtrack/src/ebpf/c/memtrack.bpf.c

@@ -43,6 +43,8 @@ BPF_HASH_MAP(pids_ppid, __u32, __u32, 10000);
 BPF_RINGBUF(events, 16 * 1024 * 1024);
 /* Map to control whether tracking is enabled (0 = disabled, 1 = enabled) */
 BPF_ARRAY_MAP(tracking_enabled, __u8, 1);
+/*  Counter for events that couldn't be added to the ring buffer */
+BPF_ARRAY_MAP(dropped_events, __u64, 1);
 
 /* == Code that tracks process forks and execs == */
 
@@ -140,6 +142,11 @@ static __always_inline __u64* take_param(void* map) {
                                                                        \
         struct event* e = bpf_ringbuf_reserve(&events, sizeof(*e), 0); \
         if (!e) {                                                      \
+            __u32 zero = 0;                                            \
+            __u64* drops = bpf_map_lookup_elem(&dropped_events, &zero);\
+            if (drops) {                                               \
+                __sync_fetch_and_add(drops, 1);                        \
+            }                                                          \
             return 0;                                                  \
         }                                                              \
                                                                        \

crates/memtrack/src/ebpf/memtrack.rs

@@ -228,6 +228,24 @@ impl MemtrackBpf {
         Ok(())
     }
 
+    /// Read the count of events dropped because the ring buffer was full.
+    pub fn dropped_events_count(&self) -> Result<u64> {
+        let key = 0u32;
+        let value = self
+            .skel
+            .maps
+            .dropped_events
+            .lookup(&key.to_le_bytes(), libbpf_rs::MapFlags::ANY)
+            .context("Failed to read dropped_events counter")?
+            .ok_or_else(|| anyhow!("dropped_events slot 0 missing"))?;
+
+        let bytes: [u8; 8] = value
+            .as_slice()
+            .try_into()
+            .map_err(|_| anyhow!("dropped_events value has unexpected size"))?;
+        Ok(u64::from_le_bytes(bytes))
+    }
+
     /// Disable event tracking
     pub fn disable_tracking(&mut self) -> Result<()> {
         let key = 0u32;

crates/memtrack/src/ebpf/tracker.rs

@@ -99,4 +99,10 @@ impl Tracker {
     pub fn disable(&mut self) -> anyhow::Result<()> {
         self.bpf.disable_tracking()
     }
+
+    /// Number of events the kernel dropped because the ring buffer was full.
+    /// A non-zero value means the resulting trace is incomplete.
+    pub fn dropped_events_count(&self) -> anyhow::Result<u64> {
+        self.bpf.dropped_events_count()
+    }
 }

crates/memtrack/src/main.rs

@@ -200,6 +200,22 @@ fn track_command(
         .join()
         .map_err(|_| anyhow::anyhow!("Failed to join writer thread"))??;
 
+    // Read the eBPF dropped-event counter after the run is complete.
+    // A non-zero value means the ring buffer overflowed and the trace is
+    // incomplete.
+    let dropped_events = tracker_arc
+        .lock()
+        .map_err(|_| anyhow!("tracker mutex poisoned"))?
+        .dropped_events_count()
+        .context("Failed to read memtrack dropped-event counter")?;
+    if dropped_events > 0 {
+        bail!(
+            "Memtrack ring buffer overflowed: {dropped_events} events lost, aborting since the trace is incomplete.\n\
+               Try reducing the benchmark's allocation rate (fewer iterations or smaller inputs), \
+               or report it at https://github.com/CodSpeedHQ/codspeed/issues."
+        );
+    }
+
     // IPC thread will exit when channel closes
     drop(ipc_handle);