<p>I'm running SystemTap on CentOS Linux release 7.6.1810. The version of SystemTap is:</p>
<pre class="lang-sh prettyprint-override"><code>$ stap -V
Systemtap translator/driver (version 4.0/0.172/0.176, rpm 4.0-11.el7)
Copyright (C) 2005-2018 Red Hat, Inc. and others
This is free software; see the source for copying conditions.
tested kernel versions: 2.6.18 ... 4.19-rc7
enabled features: AVAHI BOOST_STRING_REF DYNINST BPF JAVA PYTHON2 LIBRPM LIBSQLITE3 LIBVIRT LIBXML2 NLS NSS READLINE


$ uname -rm
3.10.0-957.21.3.el7.x86_64 x86_64

$ rpm -qa | grep kernel-devel
kernel-devel-3.10.0-957.21.3.el7.x86_64

$ rpm -qa | grep kernel-debuginfo
kernel-debuginfo-3.10.0-957.21.3.el7.x86_64
kernel-debuginfo-common-x86_64-3.10.0-957.21.3.el7.x86_64

</code></pre>
<p>I have a systemTap script named sg.stp, which use to monitor why k8s pods of a rabbitmq cluster terminated with exit code 137 occasionally:</p>
<pre class="lang-c prettyprint-override"><code>global target_pid = 32719
probe signal.send{
  if (sig_pid == target_pid) {
    printf(&quot;%s(%d) send %s to %s(%d)\n&quot;, execname(), pid(), sig_name, pid_name, sig_pid);
    printf(&quot;parent of sender: %s(%d)\n&quot;, pexecname(), ppid())
    printf(&quot;task_ancestry:%s\n&quot;, task_ancestry(pid2task(pid()), 1));
  }
}
</code></pre>
<p>When I run the script, it reported an error after a while:</p>
<pre class="lang-sh prettyprint-override"><code>$  stap sg.stp
ERROR: read fault [man error::fault] at 0x4a8 near operator '@cast' at /usr/share/systemtap/tapset/linux/task.stpm:2:5
epmd(29073) send SIGCHLD to rabbitmq-server(32719)
parent of sender: rabbitmq-server(32719)
WARNING: Number of errors: 1, skipped probes: 0
WARNING: /usr/bin/staprun exited with status: 1
Pass 5: run failed.  [man error::pass5]
</code></pre>

visionken
<p><code>pid2task()</code> can return NULL</p>
<p>Check for <code>pid2task(pid())</code> or <code>current_task()</code> returning NULL like that:</p>
<pre><code>task = pid2task(pid());
if (task) {
  printf(&quot;task_ancestry:%s\n&quot;, task_ancestry(task, 1));
} else {
  printf(&quot;task_ancestry more available\n&quot;);
}
</code></pre>
<hr />
<p>Note that I am not completely sure about following explanation:</p>
<p>It can happen that the task_struct is no more available, even when you are in the context of the running <code>pid()</code>, because the process has already died and the task_struct is cleaned up because it is no more needed.</p>
<p>In that case <code>pid2task()</code> returns NULL.  AFAICS this can happen to <code>pid()</code> in following two situations (and perhaps more):</p>
<ul>
<li><p>Your probe is asynchronous to the running process - in your case with signal probes this seems to be the case here.</p>
</li>
<li><p>The <code>.return</code> probe executes too late, perhaps because it was stuck in the kernel too long (like for blocking calls).</p>
</li>
</ul>
<p>For the latter there seems to be some easy workaround:</p>
<p>Instead of <code>task_ancestry(current_task())</code> use <code>@entry(task_ancestry(current_task()))</code>.  This way the data is gathered at the entry point of the syscall, where it is very likely that the process is still perfectly alive.</p>
<p>However in your Signal case I do not see such simple workaround, hence you must check for NULL.</p>
<hr />
<p>Note that I am not completely sure that this is your problem and that checking for NULL without some page locking is the perfect solution.  Because even if you get a pointer to some structure, the pages which contain the structure might go away in the middle of the probe, thanks to SMP.  Perhaps <code>stap</code> somehow protects against this.  But I doubt.
Race conditions like this are really weird to debug and avoid.</p>
