{"record":{"id":"634942bce6cfcd29","repo":"cilium/cilium","slug":"failed-to-lookup-subscriber-s-w","errorCode":null,"errorMessage":"failed to lookup subscriber %s: %w","messagePattern":"failed to lookup subscriber (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/maps/multicast/subscribermap.go","lineNumber":429,"sourceCode":"\t}\n\n\treturn nil\n}\n\nfunc (m SubscriberV4InnerMap) Lookup(Src netip.Addr) (*SubscriberV4, error) {\n\tval := SubscriberV4Val{}\n\n\tkey, err := NewSubscriberV4KeyFromNetIPAddr(Src)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\terr = m.Map.Lookup(key.SAddr, &val)\n\tif errors.Is(err, ebpf.ErrKeyNotExist) {\n\t\treturn nil, fmt.Errorf(\"no subscriber with source address %s: %w\", Src.String(), err)\n\t}\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to lookup subscriber %s: %w\", Src.String(), err)\n\t}\n\n\tsub, err := val.ToSubsciberV4()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn sub, nil\n}\n\nfunc (m SubscriberV4InnerMap) Delete(Src netip.Addr) error {\n\tkey, err := NewSubscriberV4KeyFromNetIPAddr(Src)\n\tif err != nil {\n\t\treturn err\n\t}\n\treturn m.Map.Delete(key)\n}\n","sourceCodeStart":411,"sourceCodeEnd":447,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/pkg/maps/multicast/subscribermap.go#L411-L447","documentation":"Generic failure wrapper for the eBPF inner-map Lookup in SubscriberV4InnerMap.Lookup, covering all errors other than ErrKeyNotExist. It signals a real syscall/fd-level failure querying the kernel map, not a missing subscriber.","triggerScenarios":"m.Map.Lookup(key.SAddr, &val) fails with something other than ErrKeyNotExist: invalid/closed map FD, insufficient capabilities, or bpf_map_lookup_elem rejected by the kernel.","commonSituations":"Agent shutting down (maps closed) while lookups in flight; running without CAP_BPF/CAP_SYS_ADMIN in restricted environments; kernel/seccomp blocking the bpf syscall.","solutions":["Run with adequate privileges (root or CAP_BPF+CAP_PERFMON / CAP_SYS_ADMIN)","Inspect the wrapped error's cause (fd state, errno) and verify the map is open","Check kernel version and seccomp/LSM policy for bpf syscall denials; verify with `bpftool map list`","Ensure shutdown ordering doesn't close maps before in-flight lookups finish"],"exampleFix":"// before\nreturn nil, fmt.Errorf(\"failed to lookup subscriber %s: %w\", Src.String(), err)\n// after\nreturn nil, fmt.Errorf(\"failed to lookup subscriber %s (fd=%d): %w\", Src.String(), m.FD(), err) // surface cause for diagnosis","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"sub, err := innerMap.Lookup(src)\nif err != nil {\n    if errors.Is(err, ebpf.ErrKeyNotExist) { return nil, ErrNotFound }\n    return fmt.Errorf(\"inner map lookup failed: %w\", err) // inspect cause: fd, caps, kernel\n}","preventionTips":["Run with required eBPF capabilities","Verify maps are open before issuing lookups during shutdown","Confirm kernel/seccomp allows bpf() syscalls"],"tags":["ebpf","map-lookup","permissions","kernel"],"backgroundTag":"ebpf-map-access-denied","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T22:30:34.772Z"}