search

dotnet / runtime

.NET is a cross-platform runtime for cloud, mobile, desktop, and IoT apps.
https://docs.microsoft.com/dotnet/core/
MIT License
14.98k stars 4.66k forks source link

Createdump will incorrectly try to classify memfd entries as files #90547

Closed hoyosjs closed 7 months ago

hoyosjs commented 1 year ago

https://github.com/dotnet/runtime/blob/b0d4502a1b89071c27e1026ee836c2883d2670e9/src/coreclr/debug/createdump/crashinfounix.cpp#L271-L275

The entries will always get collected as files incorrectly since they are called /memfd:doublemapper (deleted)

ghost commented 1 year ago

Tagging subscribers to this area: @tommcdon See info in area-owners.md if you want to be subscribed.

Issue Details
https://github.com/dotnet/runtime/blob/b0d4502a1b89071c27e1026ee836c2883d2670e9/src/coreclr/debug/createdump/crashinfounix.cpp#L271-L275 The entries will always get collected as files incorrectly since they are called `/memfd:doublemapper (deleted)`
Author: hoyosjs
Assignees: -
Labels: `area-Diagnostics-coreclr`
Milestone: -
janvorli commented 1 year ago

Maybe anything marked by (deleted) at the end should not be considered to be a file, as the (deleted) indicates the file doesn't exist in the filesystem.

tommcdon commented 1 year ago

@mikem8361

hoyosjs commented 1 year ago

Granted, system dumps seem to have these as well in NT_FILE

mikem8361 commented 1 year ago

Maybe our dump readers need to ignore them.

mikem8361 commented 1 year ago

But createdump still shouldn't add them to the module mappings and module lists, I think.

mikem8361 commented 1 year ago

Another question is whether the modules marked as (deleted) should be added to the (non-full) dumps if they don't exists in the file system. Is the memory these regions map used by the runtime still?

mikem8361 commented 1 year ago

The clrmd ELF reader removes the " (deleted) " from the module name but doesn't skip it. I added this and put the comment: 

// This substitution is for unloaded modules for which Linux appends " (deleted)" to the module name.
string path = image.FileName.Replace(" (deleted)", "");

I don't remember why I just didn't skip them.

The deleted tag seems to be on all the /memfd:doublemapper (deleted) so I think those shouldn't be in the module list built by the ELF reader but I'm not sure.

hoyosjs commented 1 year ago

deleted will always show up, they are using memfd which has no disk-backed file.