Hi Hatayama-san, > > I have a question. > > In what kind of case is only one of the offset or the size set to 0 in PT_NOTE? > > > > Thanks for your reviewing. > > On sadump processing, offset_pt_note_memory represents file offset to > a temporary file created specifically for writing PT_NOTE section. So > offset_pt_note_memory is always 0. Its file pointer is set to struct > sadump_info::file_elf_note. Please look at the end of > sadump_generate_elf_note_from_dumpfile(). > > On the other hand, on both ELF and kdump-compressed format, PT_NOTE > section is always located in the middle of the vmcores. On either > formats, there's always another header before the PT_NOTE section: on > ELF, ELF header, and on kdump-compressed format, at least. So > offset_pt_note_memory is always strictly greater than 0 on these > formats. > > If condition of has_pt_note() is not weakened in such a way, > has_pt_note() amounts to always false and execution in > write_kdump_header() always passes through writing oepration for > PT_NOTE section. Thank you for your explanation. I understand. However if (offset_pt_note_memory || size_pt_note_memory) seems to allow the offset != 0 and the size == 0. Is the following fixing right? I would like to fix has_pt_note() like this. How about this? - if (offset_pt_note_memory && size_pt_note_memory) + if (info->flag_sadump) { + if (size_pt_note_memory) + return TRUE; + } else if (offset_pt_note_memory && size_pt_note_memory) return TRUE; Thanks. Atsushi Kumagai