linux-kernel - Re: mmap'ed memory in core files ?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 2 Jul 2008 07:44:23 +1000
From:	Bron Gondwana <brong@...tmail.fm>
To:	Michael Kerrisk <mtk.manpages@...il.com>
Cc:	Philippe De Muyter <phdm@...qel.be>, linux-kernel@...r.kernel.org,
	robm@...tmail.fm
Subject: Re: mmap'ed memory in core files ?

On Tue, Jul 01, 2008 at 08:16:11PM +0200, Michael Kerrisk wrote:
> On 7/1/08, Philippe De Muyter <phdm@...qel.be> wrote:
> > Hello everybody,
> >
> >  I develop video acquisition software using the video1394 interface.
> >  The images grabbed by the camera and iee1394 bus are kept in kernel
> >  memory and made available to the user program through a mmap call done
> >  in the libdc1394 library :
> >
> >  dma_ring_buffer= mmap(0, vmmap.nb_buffers * vmmap.buf_size,
> >                 PROT_READ|PROT_WRITE,MAP_SHARED, craw->capture.dma_fd, 0);
> >
> >  Sometimes, my program crashes and produces a core file :)  It seems to
> >  me that the core file does not contain the mmap'ed memory and hence
> >  I cannot replay my program with the same image for debugging purpose.
> >
> >  Is it possible to configure the kernel through /proc, or through the mmap
> >  system call to have that mmapped segment in the core file, or do I need
> >  to modify the kernel itself to obtain the behaviour I want ?  If I
> >  need to modify the kernel, can some kind soul provide me some pointers ?
> 
> 
> Have a look at the section "Controlling which mappings are written to
> the core dump" in a recent core.5 man page:
> http://www.kernel.org/doc/man-pages/online/pages/man5/core.5.html

Interesting (and somewhat off topic to your conversation here) - it
appears that when dumping mappings, the kernel ignores the maximum
core size set with "limit".

This is particularly interesting on a 64 bit kernel where a bug in
your code causes you to try to read something about 2Gb into your
alleged mmaped file (actual size ~500 bytes) and the segfault causes
a coredump.

Bron.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/