fix(events): check if init finished in hidden kernel module (#4367)

On startup, there could be a case where a kernel module is being loaded before
the hidden kernel module initialization function is called and
finished.

pkg/events/derive/hidden_kernel_module.go

@@ -29,6 +29,7 @@ var (
 	newModuleOnlyMap         *bpf.BPFMap
 	recentDeletedModulesMap  *bpf.BPFMap
 	wakeupChannel            = make(chan ScanRequest)
+	isInitialized            = false
 )
 
 const (
@@ -53,6 +54,11 @@ func HiddenKernelModule() DeriveFunction {
 
 func deriveHiddenKernelModulesArgs() multiDeriveArgsFunction {
 	return func(event trace.Event) ([][]interface{}, []error) {
+		if !isInitialized {
+			logger.Debugw("hidden kernel module derive logic: not initialized yet... skipping")
+			return nil, nil
+		}
+
 		address, err := parse.ArgVal[uint64](event.Args, "address")
 		if err != nil {
 			return nil, []error{err}
@@ -115,7 +121,12 @@ func InitHiddenKernelModules(modsMap *bpf.BPFMap, newModMap *bpf.BPFMap, deleted
 	}
 
 	eventsFromHistoryScan, err = lru.New[*trace.Event, struct{}](50) // If there are more hidden modules found in history scan, it'll report only the size of the LRU
-	return err
+	if err != nil {
+		return err
+	}
+
+	isInitialized = true
+	return nil
 }
 
 // handleHistoryScanFinished handles the case where the history scan finished