Bug 1161911 - file command does not display "from" field correctly when run on 32 bit ppc core file
Summary: file command does not display "from" field correctly when run on 32 bit ppc c...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: file
Version: 7.0
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: rc
: ---
Assignee: Jan Kaluža
QA Contact: Stanislav Zidek
URL:
Whiteboard:
: 1162129 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-11-09 09:36 UTC by Karel Srot
Modified: 2018-12-09 19:08 UTC (History)
6 users (show)

Fixed In Version: file-5.11-23.el7
Doc Type: Bug Fix
Doc Text:
Clone Of: 1037279
Environment:
Last Closed: 2015-11-19 08:09:40 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:2155 normal SHIPPED_LIVE Moderate: file security and bug fix update 2015-11-19 08:39:11 UTC
Red Hat Knowledge Base (Solution) 543763 None None None 2018-12-09 19:08:08 UTC

Description Karel Srot 2014-11-09 09:36:53 UTC
present on rhel-7 too

$ file bz1037279/coredump-ppc
bz1037279/coredump-ppc: ELF 32-bit MSB core file, PowerPC or cisco 4500, version 1 (SYSV), SVR4-style


+++ This bug was initially created as a clone of Bug #1037279 +++

Description of problem:

On rhel5 we see the following output.

[root@rhel5 ~]# file core_crashme.tsk_linux_ppc64
core_crashme.tsk_linux_ppc64: ELF 32-bit MSB core file, PowerPC or cisco 4500, version 1 (SYSV), SVR4-style, from 'crashme.tsk'

While on rhel6 we see.

[root@rhel6 ~]# file core_crashme.tsk_linux_ppc64 
core_crashme.tsk_linux_ppc64: ELF 32-bit MSB core file, PowerPC or cisco 4500, version 1 (SYSV), SVR4-style

Version-Release number of selected component (if applicable):
file-5.04-15.el6.x86_64

How reproducible:
100%

Steps to Reproduce:
1. Find a ppc64 machine
2. create a 32 bit executable and get a core file from it
3. Run file on the core

Actual results:
core_crashme.tsk_linux_ppc64: ELF 32-bit MSB core file, PowerPC or cisco 4500, version 1 (SYSV), SVR4-style

Expected results:
core_crashme.tsk_linux_ppc64: ELF 32-bit MSB core file, PowerPC or cisco 4500, version 1 (SYSV), SVR4-style, from 'crashme.tsk'

Additional info:

eu-readelf finds the right information in the pspargs structure.

# eu-readelf -n crashme.tsk_linux_ppc64|grep fname 
     fname: crashme.tsk, psargs: ./crashme.tsk 

After much staring at this I worked out this was due to a change in the prpsoffsets32 array, specifically the removal (why?) of offset 32 which is required for ppc32 cores.

I did a git bisect and found the commit.

commit 44e1422ae38bcacf91d6ddb0893adc42bc0a5fed
Author: Christos Zoulas <christos@zoulas.com>
Date:   Thu Jun 8 20:53:31 2006 +0000

    linux changes from suse

diff --git a/src/readelf.c b/src/readelf.c
index e7a0d72..e3c1a3a 100644
--- a/src/readelf.c
+++ b/src/readelf.c
@@ -37,7 +37,7 @@
 #include "readelf.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$Id: readelf.c,v 1.55 2006/05/03 15:50:24 christos Exp $")
+FILE_RCSID("@(#)$Id: readelf.c,v 1.56 2006/06/08 20:53:31 christos Exp $")
 #endif
 
 #ifdef ELFCORE
@@ -191,15 +191,16 @@ getu64(int swap, uint64_t value)
 #ifdef ELFCORE
 size_t prpsoffsets32[] = {
        8,              /* FreeBSD */
-       28,             /* Linux 2.0.36 */
-       32,             /* Linux (I forget which kernel version) */
+       28,             /* Linux 2.0.36 (short name) */
+       44,             /* Linux (path name) */
        84,             /* SunOS 5.x */
 };
 
 size_t prpsoffsets64[] = {
        16,             /* FreeBSD, 64-bit */
-       40,             /* Linux (tested on core from 2.4.x) */
-       120,            /* SunOS 5.x, 64-bit */
+       40,             /* Linux (tested on core from 2.4.x, short name) */
+       56,             /* Linux (path name) */
+       120,            /* SunOS 5.x, 64-bit */
 };
---->8----

So I made a simple patch.

diff -up file-5.04/src/readelf.c.fix file-5.04/src/readelf.c
--- file-5.04/src/readelf.c.fix 2013-11-30 15:40:12.703462454 +1000
+++ file-5.04/src/readelf.c     2013-11-30 15:43:42.358180691 +1000
@@ -219,6 +219,7 @@ static const size_t prpsoffsets32[] = {
        84,             /* SunOS 5.x (short name) */
 
        44,             /* Linux (command line) */
+        32,             /* PowerPC */
        28,             /* Linux 2.0.36 (short name) */
 
        8,              /* FreeBSD */

I test with that and we get the old rhel5 behaviour back but it turns out this is not consistent with the behaviour for other arches. I think rather than accessing this data from the "file" field of the prpsinfo data whereas convention seems to be to access it from the psargs field.

The correct offset for that appears to be 48 but that complicates the issue as you get overlap with x86 (44).

(gdb) p &nbuf[doff + 48]
$8 = (unsigned char *) 0x7fffffffb904 "./crashme.tsk "

I'm working on a new patch that attempts to resolve that.

Comment 1 Jan Kaluža 2014-11-10 11:18:05 UTC
*** Bug 1162129 has been marked as a duplicate of this bug. ***

Comment 7 errata-xmlrpc 2015-11-19 08:09:40 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-2155.html


Note You need to log in before you can comment on or make changes to this bug.