On Tue, 25 Feb 2014 23:03:43 +0100, Mark Wielaard wrote: > On Sat, 2014-02-22 at 22:08 +0100, Jan Kratochvil wrote: > > jankratochvil/devmem > > The name, the subject and some of the comments talks about /dev. > But I assume this is really about /proc?
Right, there isn't anything related to "dev", my mistake. > > (3) > > There is currently a bug in symbol resolving (eu-stack without -q) of > > deleted > > prelinked executables. > > > > This is because this libdwfl/dwfl_module_getdwarf.c comment is no longer > > true > > after this patch > > If there are no section headers at all (full stripping), then > > the end of the first segment is a valid synchronization address. > > This cannot happen in a prelinked file, since prelink itself > > relies on section headers for prelinking and for undoing it. > > (If you do full stripping on a prelinked file, then you get what > > you deserve--you can neither undo the prelinking, nor expect to > > line it up with a debug file separated before prelinking.) > > > > because /proc/PID/mem does not have to have section headers mapped. > > > > Primarily I am not aware how to fix it. > > I also don't immediately know how. But nice find. This seems somewhat > obscure. It means, the main ELF file is deleted, but you do still have > the separate debuginfo file around, which we find (based on build-id) > and then cannot properly match/sync because the main, now deleted, file > was prelinked. I think in general the main file and the separate > debuginfo file will both be deleted. It is a slightly confusing corner > case though. On a system with prelink it can commonly happen: Install daemon.rpm and daemon-debuginfo.rpm. During some night cron.daily runs prelink, /usr/bin/daemon gets prelinked. Start daemon - it will be started prelinked. Some night cron.daily runs prelink again and, it may re-prelink whole system as PRELINK_FULL_TIME_INTERVAL=14 just happened. daemon in memory is "daemon (deleted)" running prelinked executable. State of /usr/bin/daemon does not matter now anymore. /usr/lib/debug/usr/bin/daemon.debug still exists (it is always unprelinked). Run eu-stack -p `pidof daemon`. In this case it will fail: In-memory deleted executable is not expected to be prelinked by the paragraph above while in reality it is prelinked. Therefore elfutils wrongly matches it to /usr/lib/debug/usr/bin/daemon.debug which is not prelinked. This is a pretty normal case on a system using prelink. I was more hoping here that in reality prelink is/will not be in use much. Also it is not a regression - processes with deleted files could not be backtraced at all so far. Regards, Jan
