Public bug reported: eventstat checks to see if a process is a kernel thread by checking /proc/$pid/exe - however, sometimes processes die before we can open /proc/$pid/exe and it defaults to assuming the exe was not found and hence it was a kernel thread rather than that it was a normal userland process.
Instead, it should open /proc/$pid and if does not exist, assume it was a short lived process (which is more likely). If this opens OK, then it should check if /proc/$pid/exe exists or not. To avoid TOUTOC (time of check, time of use) races, use openat on /proc/pid ** Affects: eventstat (Ubuntu) Importance: Medium Assignee: Colin King (colin-king) Status: In Progress ** Changed in: eventstat (Ubuntu) Status: New => In Progress ** Changed in: eventstat (Ubuntu) Importance: Undecided => Medium ** Changed in: eventstat (Ubuntu) Assignee: (unassigned) => Colin King (colin-king) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1226787 Title: eventstat: sometimes detection of a kernel thread is wrong To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/eventstat/+bug/1226787/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs