Call RefDec in exit only if not cached processes

Now eventcache handles the RefDec() calls both for process and parent if the exit event goes into the eventcache. So calling RefDec() before checking if we need to cache the event may results in double calls to RefDec(). Signed-off-by: Anastasios Papagiannis <[email protected]>
cilium · Aug 12, 2022 · 03bdc1c · 03bdc1c
1 parent 7e7b2b4
commit 03bdc1c
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 3 deletions.
diff --git a/pkg/grpc/exec/exec.go b/pkg/grpc/exec/exec.go
@@ -166,7 +166,6 @@ func GetProcessExit(event *MsgExitEventUnix) *tetragon.ProcessExit {
 
 	process, parent := process.GetParentProcessInternal(event.ProcessKey.Pid, event.ProcessKey.Ktime)
 	if process != nil {
-		process.RefDec()
 		tetragonProcess = process.UnsafeGetProcess()
 	} else {
 		tetragonProcess = &tetragon.Process{
@@ -175,7 +174,6 @@ func GetProcessExit(event *MsgExitEventUnix) *tetragon.ProcessExit {
 		}
 	}
 	if parent != nil {
-		parent.RefDec()
 		tetragonParent = parent.GetProcessCopy()
 	}
 
@@ -195,7 +193,11 @@ func GetProcessExit(event *MsgExitEventUnix) *tetragon.ProcessExit {
 		ec.Add(process, tetragonEvent, event.ProcessKey.Ktime, event)
 		return nil
 	}
+	if parent != nil {
+		parent.RefDec()
+	}
 	if process != nil {
+		process.RefDec()
 		tetragonEvent.Process = process.GetProcessCopy()
 	}
 	return tetragonEvent

diff --git a/pkg/grpc/exec/exec_test.go b/pkg/grpc/exec/exec_test.go
@@ -764,7 +764,7 @@ func TestGrpcParentRefcntInOrder(t *testing.T) {
 	assert.Equal(t, currentExitEv.Process.Pid.Value, currentPid)
 	assert.Equal(t, currentExitEv.Process.Refcnt, uint32(0))
 	assert.Equal(t, currentExitEv.Parent.Pid.Value, parentPid)
-	assert.Equal(t, currentExitEv.Parent.Refcnt, uint32(1))
+	assert.Equal(t, currentExitEv.Parent.Refcnt, uint32(2))
 
 	// 4th event: exit from parent
 	// 1. should match pid of parent