tetragon: remove unnecessary GetProcessCopy()

GetProcessCopy is required when we need to modify the Process info.
This is done primarily to update the Tid to reflect the caller of
a system call or kprobe.

Most other cases shouldn't need to get a fully copy of the process
object. The reason a copy is needed in the modification case is
to avoid having a writer updating the object while the GRPC
stream handler or JSON writer are marshalling the data which can
corrupt the streaming logic. This results in either broken messages
in JSON export file or the GRPC stream failing.

Signed-off-by: John Fastabend <[email protected]>

pkg/eventcache/eventcache.go

@@ -62,7 +62,7 @@ func HandleGenericInternal(ev notify.Event, pid uint32, tid *uint32, timestamp u
 	var err error
 
 	if parent != nil {
-		ev.SetParent(parent.GetProcessCopy())
+		ev.SetParent(parent.UnsafeGetProcess())
 	} else {
 		errormetrics.ErrorTotalInc(errormetrics.EventCacheParentInfoFailed)
 		err = ErrFailedToGetParentInfo

pkg/grpc/exec/exec.go

@@ -77,7 +77,6 @@ func GetProcessExec(event *MsgExecveEventUnix, useCache bool) *tetragon.ProcessE
 
 	if parent != nil {
 		parent.RefInc()
-		tetragonEvent.Parent = parent.GetProcessCopy()
 	}
 
 	// do we need to cleanup anything?
@@ -186,7 +185,7 @@ func (msg *MsgExecveEventUnix) Retry(internal *process.ProcessInternal, ev notif
 	// want to panic anyway to help us catch the bug faster. So no need to do a nil check
 	// here.
 	internal.AddPodInfo(podInfo)
-	ev.SetProcess(internal.GetProcessCopy())
+	ev.SetProcess(internal.UnsafeGetProcess())
 
 	// Check we have a parent with exception for pid 1, note we do this last because we want
 	// to ensure the podInfo and process are set before returning any errors.
@@ -197,7 +196,7 @@ func (msg *MsgExecveEventUnix) Retry(internal *process.ProcessInternal, ev notif
 			return err
 		}
 		parent.RefInc()
-		ev.SetParent(parent.GetProcessCopy())
+		ev.SetParent(parent.UnsafeGetProcess())
 	}
 
 	// do we need to cleanup anything?
@@ -305,11 +304,10 @@ func GetProcessExit(event *MsgExitEventUnix) *tetragon.ProcessExit {
 	}
 	if parent != nil {
 		parent.RefDec()
-		tetragonEvent.Parent = parent.GetProcessCopy()
 	}
 	if proc != nil {
-		proc.RefDec()
 		tetragonEvent.Process = proc.GetProcessCopy()
+		proc.RefDec()
 		// Use the bpf recorded TID to update the event
 		process.UpdateEventProcessTid(tetragonEvent.Process, &event.Info.Tid)
 	}
@@ -330,11 +328,11 @@ func (msg *MsgExitEventUnix) RetryInternal(ev notify.Event, timestamp uint64) (*
 	var err error
 
 	if parent != nil {
+		ev.SetParent(parent.UnsafeGetProcess())
 		if !msg.RefCntDone[ParentRefCnt] {
 			parent.RefDec()
 			msg.RefCntDone[ParentRefCnt] = true
 		}
-		ev.SetParent(parent.GetProcessCopy())
 	} else {
 		errormetrics.ErrorTotalInc(errormetrics.EventCacheParentInfoFailed)
 		err = eventcache.ErrFailedToGetParentInfo

pkg/grpc/tracing/tracing.go

@@ -237,7 +237,7 @@ func GetProcessKprobe(event *MsgGenericKprobeUnix) *tetragon.ProcessKprobe {
 		process.UpdateEventProcessTid(tetragonEvent.Process, &event.Tid)
 	}
 	if parent != nil {
-		tetragonEvent.Parent = parent.GetProcessCopy()
+		tetragonEvent.Parent = tetragonParent
 	}
 
 	return tetragonEvent
@@ -334,11 +334,10 @@ func (msg *MsgGenericTracepointUnix) HandleMessage() *tetragon.GetEventsResponse
 	if proc != nil {
 		tetragonEvent.Process = proc.GetProcessCopy()
 		// Use the bpf recorded TID to update the event
+		// The cost to get this is relatively high because it requires a
+		// deep copyo of the process in order to safely modify it.
 		process.UpdateEventProcessTid(tetragonEvent.Process, &msg.Tid)
 	}
-	if parent != nil {
-		tetragonEvent.Parent = parent.GetProcessCopy()
-	}
 
 	return &tetragon.GetEventsResponse{
 		Event:    &tetragon.GetEventsResponse_ProcessTracepoint{ProcessTracepoint: tetragonEvent},
@@ -557,10 +556,6 @@ func GetProcessUprobe(event *MsgGenericUprobeUnix) *tetragon.ProcessUprobe {
 		// Use the bpf recorded TID to update the event
 		process.UpdateEventProcessTid(tetragonEvent.Process, &event.Tid)
 	}
-	if parent != nil {
-		tetragonEvent.Parent = parent.GetProcessCopy()
-	}
-
 	return tetragonEvent
 }