[GH-ISSUE #180] fix(application): include non-leader thread children in Linux process sampling #128

Closed
opened 2026-10-15 18:21:23 +00:00 by bsakaguchi · 0 comments
Owner

Originally created by @morluto on GitHub (Jul 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/180

Problem

src/application/ProcessSampling.ts discovers process descendants from /proc/${pid}/task/${pid}/children for each sampled PID.
That path represents children associated with one thread (TID == PID) only.

Evidence

  • readLinuxChildren hardcodes /proc/${pid}/task/${pid}/children and returns undefined only on read failure.
  • sampleLinux uses that child list directly and only falls back to ps when readLinuxChildren throws.

Reference implementation:

  • src/application/ProcessSampling.ts:107-126 (readLinuxChildren)
  • src/application/ProcessSampling.ts:173-183 (sampleLinux fallback guard)

Impact

In multithreaded Linux processes, children spawned by non-leader threads can be missed from process_samples, creating incomplete process-tree evidence and reducing confidence in process lineage comparisons.

Reproduction idea

Run a capture for a multithreaded program that intentionally forks from a worker thread, then compare process_samples[].pid and parent_pid with a concurrent ps tree snapshot.

Suggested fix

When using the Linux fast-path sampler, gather children from all process threads under /proc/${pid}/task/*/children (dedupe per parent), not only /task/${pid}/children, then continue BFS with existing parent-identity checks.

Originally created by @morluto on GitHub (Jul 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/180 ## Problem `src/application/ProcessSampling.ts` discovers process descendants from `/proc/${pid}/task/${pid}/children` for each sampled PID. That path represents children associated with one thread (TID == PID) only. ## Evidence - `readLinuxChildren` hardcodes `/proc/${pid}/task/${pid}/children` and returns undefined only on read failure. - `sampleLinux` uses that child list directly and only falls back to `ps` when `readLinuxChildren` throws. Reference implementation: - `src/application/ProcessSampling.ts:107-126` (`readLinuxChildren`) - `src/application/ProcessSampling.ts:173-183` (`sampleLinux` fallback guard) ## Impact In multithreaded Linux processes, children spawned by non-leader threads can be missed from `process_samples`, creating incomplete process-tree evidence and reducing confidence in process lineage comparisons. ## Reproduction idea Run a capture for a multithreaded program that intentionally forks from a worker thread, then compare `process_samples[].pid` and `parent_pid` with a concurrent `ps` tree snapshot. ## Suggested fix When using the Linux fast-path sampler, gather children from all process threads under `/proc/${pid}/task/*/children` (dedupe per parent), not only `/task/${pid}/children`, then continue BFS with existing parent-identity checks.
bsakaguchi 2026-10-15 18:21:23 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#128
No description provided.