Select Page

Traversing a VMA red-black tree in Linux

void dfs(struct rb_node *node) { struct vm_area_struct *vma; vma = rb_entry(node, struct vm_area_struct, vm_rb); trace_printk(“VMA: [0x%px – 0x%px]”, (void *)vma->vm_start, (void *)vma->vm_end); if (node->rb_left) dfs(node->rb_left); if...

“parent” vs. “real_parent” in struct task_struct

TL;DR: If process B is tracing process A using something like ptrace(), then B is the parent of A.  In that case, B is not necessarily the real_parent of A. If B creates A (e.g. using fork()) but terminates before A, then init (PID 1) now becomes both the parent...