Re: [patch] Fix resolving ELF symbols for live PIDs with deleted files

[Jan Kratochvil <jan.kratochvil@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 1054 bytes --]

On Fri, 29 Aug 2014 11:55:32 +0200, Mark Wielaard wrote:
> On Thu, 2014-08-28 at 22:12 +0200, Jan Kratochvil wrote:
> > +# Older Linux (such as 2.6.32) required PTRACE_ATTACH to read /proc/PID/mem.
> > +sleep 60 & p=$!; sleep 0.1
> > +addr=0x$(cat /proc/$p/maps|sed -n 's#^\([0-9a-f]*\)-[0-9a-f]* r[^ ]* 00* .*/sleep$#\1#p'|head -n1)
> > +supported=$[$(dd if=/proc/$p/mem bs=1 skip=$[$addr] count=1|wc -c)]
> > +kill -9 $p
> > +if [ $supported -eq 0 ]; then
> > +  exit 77
> > +fi
>  
> I don't think this check is needed. eu-stack needs to be attached to get
> the register values and dwfl_linux_proc_find_elf makes sure the process
> is attached before calling elf_from_remote_memory.

When I remove the check on 2.6.32 (tested on kernel-2.6.32-431.el6.x86_64) the
testcase really FAILs:
	.../elfutils/src/stack: dwfl_thread_getframes tid 26376 at 0x4006c8 in .../elfutils/tests/deleted: no matching address range

I can debug it further but I guess at least this patch could go in as is (with
the kernel check).


Thanks,
Jan