Bug 1342671 - coredump produced corrupted ELF file
Summary: coredump produced corrupted ELF file
Alias: None
Product: Fedora
Classification: Fedora
Component: kernel
Version: rawhide
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
Assignee: Mateusz Guzik
QA Contact: Fedora Extras Quality Assurance
Depends On:
TreeView+ depends on / blocked
Reported: 2016-06-03 20:25 UTC by Zbigniew Jędrzejewski-Szmek
Modified: 2016-06-08 23:12 UTC (History)
10 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2016-06-08 23:12:11 UTC
Type: Bug

Attachments (Terms of Use)
readelf output for bash core file, kernel 4.7.0-0.rc0.git4.1.fc25.x86_64 (7.97 KB, text/plain)
2016-06-03 20:26 UTC, Zbigniew Jędrzejewski-Szmek
no flags Details

Description Zbigniew Jędrzejewski-Szmek 2016-06-03 20:25:26 UTC
Description of problem:
Running gdb or readelf on a coredump file gives the following output:
"/var/tmp/coredump-6H6at9" is not a core dump: File format not recognized
I'll attach readelf output later on.
The size of the corefile is plausible, and the ELF headers are there, so it's not totally bonkers, just somehow corrupted.

Version-Release number of selected component (if applicable):
kernel-4.7.0-0.rc0.git4.1.fc25.x86_64 is first bad
kernel-4.7.0-0.rc0.git3.1.fc25.x86_64 is last good

How reproducible:

Steps to Reproduce:
1. sudo sysctl -w kernel.core_pattern='|/bin/tee /var/tmp/core.%p'
2. bash -c 'kill -SEGV $$'
3. gdb /var/tmp/core.XXX

Note that using kernel.core_pattern without "|", i.e. dumping directly to a file, works.

Comment 1 Zbigniew Jędrzejewski-Szmek 2016-06-03 20:26:45 UTC
Created attachment 1164631 [details]
readelf output for bash core file, kernel 4.7.0-0.rc0.git4.1.fc25.x86_64

Comment 2 Mateusz Guzik 2016-06-05 11:58:01 UTC
Thanks for a nice bugreport. I posted a fix here:

Comment 3 Laura Abbott 2016-06-08 21:46:23 UTC
Let me know when the patch gets Acked/Accpeted and I'll pull it into rawhide.

Comment 5 Laura Abbott 2016-06-08 23:12:11 UTC
The patch came in in today's rawhide. I didn't realize that before I posted my comment. Closing the bug now.

Note You need to log in before you can comment on or make changes to this bug.