Open Radar

 
When I receive a NOTE_FORK event from a kqueue, then both data and udata are empty. I expect them to have a pid of the child process, otherwise it is not very useful.

Steps to Reproduce:
Take an attachment, compile it using the following command:

clang++ main.cpp

Run the a.out:

./a.out

Observed Results:
pid 47151 called fork()
	data: 0
	udata: 0x0

Expected Results:
pid 47151 called fork()
	data: <pid of a child process here>
	udata: <or here>

The source code:

#include <err.h>
#include <iostream>
#include <thread>
#include <signal.h>
#include <sys/event.h>
#include <sys/time.h>
#include <sys/types.h>
#include <unistd.h>

using namespace std;

void observer_main() {
  pid_t pid = getpid();
  int queue = kqueue();
  if (queue == -1) {
    err(1, "kqueue");
  }

  struct kevent ke;

  EV_SET(&ke, pid, EVFILT_PROC, EV_ADD,
         NOTE_EXIT | NOTE_FORK | NOTE_EXEC | NOTE_SIGNAL, 0, NULL);

  int i = kevent(queue, &ke, 1, NULL, 0, NULL);
  if (i == -1)
    err(1, "proc kevent!");

  while (true) {

    memset(&ke, 0x00, sizeof(struct kevent));

    i = kevent(queue, NULL, 0, &ke, 1, NULL);
    if (i == -1) {
      err(1, "kevent!");
    }

    printf("%d\n", ke.flags);

    if (ke.fflags & NOTE_FORK) {
      printf("pid %lu called fork()\n", ke.ident);
      printf("\tdata: %lu\n", ke.data);
      printf("\tudata: %p\n", ke.udata);
    }
    if (ke.fflags & NOTE_CHILD)
      printf("pid %lu has %lu as parent\n", ke.ident,
             ke.data);
  }
}

int main(int argc, const char * argv[]) {
  thread t(observer_main);

  printf("Hello, World!\n");

  sleep(2);

  pid_t child = fork();
  if (child != 0) {
    sleep(2);
    kill(child, 9);
  }

  while (true) {}

  return 0;
}