diff --git a/pkg/eventcache/eventcache.go b/pkg/eventcache/eventcache.go index f0b259d05aa..502d32570fb 100644 --- a/pkg/eventcache/eventcache.go +++ b/pkg/eventcache/eventcache.go @@ -62,7 +62,7 @@ func HandleGenericInternal(ev notify.Event, pid uint32, tid *uint32, timestamp u var err error if parent != nil { - ev.SetParent(parent.GetProcessCopy()) + ev.SetParent(parent.UnsafeGetProcess()) } else { errormetrics.ErrorTotalInc(errormetrics.EventCacheParentInfoFailed) err = ErrFailedToGetParentInfo diff --git a/pkg/grpc/exec/exec.go b/pkg/grpc/exec/exec.go index 217b6811aeb..57afffc7658 100644 --- a/pkg/grpc/exec/exec.go +++ b/pkg/grpc/exec/exec.go @@ -77,7 +77,6 @@ func GetProcessExec(event *MsgExecveEventUnix, useCache bool) *tetragon.ProcessE if parent != nil { parent.RefInc() - tetragonEvent.Parent = parent.GetProcessCopy() } // do we need to cleanup anything? @@ -186,7 +185,7 @@ func (msg *MsgExecveEventUnix) Retry(internal *process.ProcessInternal, ev notif // want to panic anyway to help us catch the bug faster. So no need to do a nil check // here. internal.AddPodInfo(podInfo) - ev.SetProcess(internal.GetProcessCopy()) + ev.SetProcess(internal.UnsafeGetProcess()) // Check we have a parent with exception for pid 1, note we do this last because we want // to ensure the podInfo and process are set before returning any errors. @@ -197,7 +196,7 @@ func (msg *MsgExecveEventUnix) Retry(internal *process.ProcessInternal, ev notif return err } parent.RefInc() - ev.SetParent(parent.GetProcessCopy()) + ev.SetParent(parent.UnsafeGetProcess()) } // do we need to cleanup anything? @@ -305,11 +304,10 @@ func GetProcessExit(event *MsgExitEventUnix) *tetragon.ProcessExit { } if parent != nil { parent.RefDec() - tetragonEvent.Parent = parent.GetProcessCopy() } if proc != nil { - proc.RefDec() tetragonEvent.Process = proc.GetProcessCopy() + proc.RefDec() // Use the bpf recorded TID to update the event process.UpdateEventProcessTid(tetragonEvent.Process, &event.Info.Tid) } @@ -330,11 +328,11 @@ func (msg *MsgExitEventUnix) RetryInternal(ev notify.Event, timestamp uint64) (* var err error if parent != nil { + ev.SetParent(parent.UnsafeGetProcess()) if !msg.RefCntDone[ParentRefCnt] { parent.RefDec() msg.RefCntDone[ParentRefCnt] = true } - ev.SetParent(parent.GetProcessCopy()) } else { errormetrics.ErrorTotalInc(errormetrics.EventCacheParentInfoFailed) err = eventcache.ErrFailedToGetParentInfo diff --git a/pkg/grpc/tracing/tracing.go b/pkg/grpc/tracing/tracing.go index b4cf38d90e8..278d197421d 100644 --- a/pkg/grpc/tracing/tracing.go +++ b/pkg/grpc/tracing/tracing.go @@ -237,7 +237,7 @@ func GetProcessKprobe(event *MsgGenericKprobeUnix) *tetragon.ProcessKprobe { process.UpdateEventProcessTid(tetragonEvent.Process, &event.Tid) } if parent != nil { - tetragonEvent.Parent = parent.GetProcessCopy() + tetragonEvent.Parent = tetragonParent } return tetragonEvent @@ -334,11 +334,10 @@ func (msg *MsgGenericTracepointUnix) HandleMessage() *tetragon.GetEventsResponse if proc != nil { tetragonEvent.Process = proc.GetProcessCopy() // Use the bpf recorded TID to update the event + // The cost to get this is relatively high because it requires a + // deep copyo of the process in order to safely modify it. process.UpdateEventProcessTid(tetragonEvent.Process, &msg.Tid) } - if parent != nil { - tetragonEvent.Parent = parent.GetProcessCopy() - } return &tetragon.GetEventsResponse{ Event: &tetragon.GetEventsResponse_ProcessTracepoint{ProcessTracepoint: tetragonEvent}, @@ -557,10 +556,6 @@ func GetProcessUprobe(event *MsgGenericUprobeUnix) *tetragon.ProcessUprobe { // Use the bpf recorded TID to update the event process.UpdateEventProcessTid(tetragonEvent.Process, &event.Tid) } - if parent != nil { - tetragonEvent.Parent = parent.GetProcessCopy() - } - return tetragonEvent }