Skip to content

Commit d31622e

Browse files
authored
Fix nil pointer panic in TestTryReparentFromKernelPPid (#49248)
### What does this PR do? Use a PID above `pid_max` (4,194,304) as the unresolvable ppid in the `different-ppid-parent-not-in-cache` subtest of `TestTryReparentFromKernelPPid`, matching the convention already used elsewhere in the file. ### Motivation The test was using ppid `99997` to exercise the "parent not in cache and unresolvable" path. On a busy CI runner where that PID happens to exist, `resolveFromProcfs` would succeed and actually reparent the process, causing the test to fail nondeterministically. Using a PID above `pid_max` guarantees it can never exist in procfs regardless of host state. Failing job: https://gitlab.ddbuild.io/DataDog/datadog-agent/-/jobs/1588964315 ### Describe how you validated your changes CI ### Additional Notes Co-authored-by: pierre.gimalac <pierre.gimalac@datadoghq.com>
1 parent 1e4fad6 commit d31622e

1 file changed

Lines changed: 3 additions & 2 deletions

File tree

pkg/security/resolvers/process/resolver_test.go

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1214,8 +1214,9 @@ func TestTryReparentFromKernelPPid(t *testing.T) {
12141214
resolver.AddForkEntry(parent, model.CGroupContext{}, nil)
12151215
resolver.AddForkEntry(child, model.CGroupContext{}, nil)
12161216

1217-
// Kernel reports ppid=99997 which is not in cache and unresolvable
1218-
resolver.TryReparentFromKernelPPid(child.ProcessCacheEntry, 99997, nil)
1217+
// Kernel reports a ppid above pid_max (4194304) so it can never exist in
1218+
// procfs and is guaranteed to be unresolvable regardless of host state.
1219+
resolver.TryReparentFromKernelPPid(child.ProcessCacheEntry, 5_000_099, nil)
12191220

12201221
assert.Equal(t, uint32(5000020), child.ProcessCacheEntry.PPid)
12211222
assert.Equal(t, parent.ProcessCacheEntry, child.ProcessCacheEntry.Ancestor)

0 commit comments

Comments
 (0)