On Aug 6, 2024, at 10:21 PM, Kees Cook <kees@xxxxxxxxxx> wrote: > > On Tue, 06 Aug 2024 18:16:02 +0000, Brian Mak wrote: >> Large cores may be truncated in some scenarios, such as with daemons >> with stop timeouts that are not large enough or lack of disk space. This >> impacts debuggability with large core dumps since critical information >> necessary to form a usable backtrace, such as stacks and shared library >> information, are omitted. >> >> We attempted to figure out which VMAs are needed to create a useful >> backtrace, and it turned out to be a non-trivial problem. Instead, we >> try simply sorting the VMAs by size, which has the intended effect. >> >> [...] > > While waiting on rr test validation, and since we're at the start of the > dev cycle, I figure let's get this into -next ASAP to see if anything > else pops out. We can drop/revise if there are problems. (And as always, > I will add any Acks/Reviews/etc that show up on the thread.) > > Applied to for-next/execve, thanks! > > [1/1] binfmt_elf: Dump smaller VMAs first in ELF cores > https://urldefense.com/v3/__https://git.kernel.org/kees/c/9c531dfdc1bc__;!!NEt6yMaO-gk!FK3UfXVndoYpve8Y7q7vacIoHOrTj2nJgSJbugqUB5LfciKy0_Xvit9aXz_XCWlXHpdRQO2ArP0$ Thanks, Kees! And, thanks Linus + Eric for taking the time to comment on this. Regarding the rr tests, it was not an easy task to get the environment set up to do this, but I did it and was able to run the tests. The rr tests require a lot of kernel config options and there's no list documenting what's needed anywhere... All the tests pass except for the sioc and sioc-no-syscallbuf tests. However, these test failures are due to an incompatibility with the network adapter I'm using. It seems that it only likes older network adapters. I've switched my virtualized network adapter twice now, and each time, the test gets a bit further than the previous time. Will continue trying different network adapters until something hopefully works. In any case, since this error isn't directly related to my changes and the rest of the tests pass, then I think we can be pretty confident that this change is not breaking rr. Best, Brian Mak > Take care, > > -- > Kees Cook >
