pid2task() can return NULL

Check for pid2task(pid()) or current_task() returning NULL like that:

task = pid2task(pid());
if (task) {
  printf("task_ancestry:%s\n", task_ancestry(task, 1));
} else {
  printf("task_ancestry more available\n");
}

Note that I am not completely sure about following explanation:

It can happen that the task_struct is no more available, even when you are in the context of the running pid(), because the process has already died and the task_struct is cleaned up because it is no more needed.

In that case pid2task() returns NULL. AFAICS this can happen to pid() in following two situations (and perhaps more):

• Your probe is asynchronous to the running process - in your case with signal probes this seems to be the case here.

• The .return probe executes too late, perhaps because it was stuck in the kernel too long (like for blocking calls).

For the latter there seems to be some easy workaround:

Instead of task_ancestry(current_task()) use @entry(task_ancestry(current_task())). This way the data is gathered at the entry point of the syscall, where it is very likely that the process is still perfectly alive.

However in your Signal case I do not see such simple workaround, hence you must check for NULL.

Note that I am not completely sure that this is your problem and that checking for NULL without some page locking is the perfect solution. Because even if you get a pointer to some structure, the pages which contain the structure might go away in the middle of the probe, thanks to SMP. Perhaps stap somehow protects against this. But I doubt. Race conditions like this are really weird to debug and avoid.