[BUG] libsinsp-example crash on arm64 + modern_bpf

[therealbobo]

Describe the bug

Running the sinsp-example test program on an arm64 host with the modern_bpf driver causes a seg fault. Looking at it with a debugger it seems that the root cause is related to malformed events a the scap level and it is really likely a modern_bpf driver problem.

How to reproduce it

1. Patch the sinsp-example program removing the output (for some reason this step is essential to get the repro)

diff --git a/userspace/libsinsp/examples/test.cpp b/userspace/libsinsp/examples/test.cpp
index d0334b4bd..f7fc55c2b 100644
--- a/userspace/libsinsp/examples/test.cpp
+++ b/userspace/libsinsp/examples/test.cpp
@@ -415,11 +415,12 @@ int main(int argc, char** argv) {
                        cout << "[ERROR] " << error_msg << endl;
                });
                if(ev != nullptr) {
-                       sinsp_threadinfo* thread = ev->get_thread_info();
-                       if(!thread || g_all_threads || thread->is_main_thread()) {
-                               dump(inspector, ev);
-                               num_events++;
-                       }
+                       //sinsp_threadinfo* thread = ev->get_thread_info();
+                       //if(!thread || g_all_threads || thread->is_main_thread()) {
+                       //      dump(inspector, ev);
+                       //      num_events++;
+                       //}
                }
        }
        std::chrono::steady_clock::time_point end = std::chrono::steady_clock::now();

2. Run sinsp-example -m
3. Once the capture is started run stress-ng --exec 1 --open 1 and the crash should appear almost immediately.

Expected behaviour

There should not be any malformed event.

Screenshots

Environment

• Falco version: master
• System info:

{
  "machine": "aarch64",
  "nodename": "redacted",
  "release": "6.5.0-1022-aws",
  "sysname": "Linux",
  "version": "#22~22.04.1-Ubuntu SMP Fri Jun 14 19:23:09 UTC 2024"
}

• Cloud provider or hardware configuration: ec2 arm64 machine
• OS:

PRETTY_NAME="Ubuntu 22.04.4 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.4 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=jammy

• Kernel:

Linux redacted 6.5.0-1022-aws #22~22.04.1-Ubuntu SMP Fri Jun 14 19:23:09 UTC 2024 aarch64 aarch64 aarch64 GNU/Linux

• Installation method:
  source

Additional context

[LucaGuerra]

/milestone 0.18.0