Duplicate EXIT record for sudo process

Duplicate EXIT record for sudo process

[Thomas-Mich Richter]

I have installed linux 4.14 and discovered a duplicate entry of type
PERF_RECORD_EXIT in the perf data file. A process has 1 FORK and 2 EXIT records.
It is simple to recreate.  You need two shells:

Run command as root in shell 1:
[root@s35lp76 perf]# ./perf record -a -n

Now open a new shell as non-root user and run command
shell 2:
[tmricht@s35lp76 ~]$ sudo ls -l /

As soon as the sudo command finishes, cntrl-C the perf record in
shell 1 and look at the perf.data file.

5 295009586070 0x23288 [0x38]: PERF_RECORD_FORK(22592:22592):(22562:22562)
5 295010239273 0x24b00 [0x30]: PERF_RECORD_COMM exec: sudo:22592/22592
5 295010243323 0x24b30 [0x38]: PERF_RECORD_EXIT(22592:22592):(22592:22592)
5 295010261805 0x24b68 [0x70]: PERF_RECORD_MMAP2 22592/22592:
        [0x118d00000(0x27000) @ 0 5e:01 268957 361132184]: r-xp /usr/bin/sudo
5 295010299013 0x24bd8 [0x78]: PERF_RECORD_MMAP2 22592/22592:
        [0x3ffbac00000(0x2b000) @ 0 5e:01 271462 361135670]:
        r-xp /usr/lib64/ld-2.26.so
...                               
0 295028626784 0x22118 [0x38]: PERF_RECORD_FORK(22596:22596):(22592:22592)
4 295029581934 0x24458 [0x30]: PERF_RECORD_COMM exec: ls:22596/22596
... 
4 295034690214 0x248d0 [0x38]: PERF_RECORD_EXIT(22596:22596):(22596:22596)
0 295040438756 0x22150 [0x38]: PERF_RECORD_EXIT(22592:22592):(22592:22592)
                                                              
The sudo command (pid 22592) is FORK'ed and EXEC'ed and
immediately follows an EXIT record, even before the MMAP2 records
show up. Later sudo forks command ls (pid 22596) and finally both processes
are terminated resulting in the second EXIT record for process sudo (22952).

Is this intended?

-- 
Thomas Richter, Dept 3303, IBM LTC Boeblingen Germany
--
Vorsitzende des Aufsichtsrats: Martina Koederitz 
Geschäftsführung: Dirk Wittkopp
Sitz der Gesellschaft: Böblingen / Registergericht: Amtsgericht Stuttgart, HRB 243294