illumos gate

I’m debugging a problem with truncated coredumps caused by my application. It turns out, that my application opens a file descriptor within a snapshot (.zfs/snapshot/…), then destroys the snapshot, and calls abort(). The core function fails with 1 and the created coredump is corrupt:

Log message: genunix: [ID 457380 kern.notice] NOTICE: core_log: corebug[2870] core dump failed, errno=5

# pstack /var/tmp/core.corebug.847
pstack: cannot examine /var/tmp/core.corebug.847: core file is corrupt or missing required data

# ls -la /var/tmp/core.bcorebug.847
-rw-------   1 root     root       83512 Mar 17 11:28 /var/tmp/core.bcorebug.847

I think this shouldn’t happen. I wrote a little reproducer (see attachment):

# dtrace -n 'core:return {trace(arg1);} zfs_getattr:return, zfs_lookup:return/arg1==5/{trace(arg1); stack();}'
dtrace: description 'core:return ' matched 3 probes
CPU     ID                    FUNCTION:NAME
 11  39346                zfs_lookup:return                 5
              genunix`fop_lookup+0xa2
              genunix`dirtopath+0x314
              genunix`vnodetopath_common+0x3cb
              genunix`vnodetopath+0x24
              elfexec`write_elfnotes32+0x64b
              elfexec`elf32core+0x9de
              genunix`do_core+0x18a
              genunix`dump_one_core+0x139
              genunix`core+0x360
              genunix`psig+0x594
              genunix`post_syscall+0x82d
              genunix`syscall_exit+0x68
              unix`0xfffffffffb800ed9

 11  39360               zfs_getattr:return                 5
              genunix`fop_getattr+0xa8
              elfexec`write_elfnotes32+0x662
              elfexec`elf32core+0x9de
              genunix`do_core+0x18a
              genunix`dump_one_core+0x139
              genunix`core+0x360
              genunix`psig+0x594
              genunix`post_syscall+0x82d
              genunix`syscall_exit+0x68
              unix`0xfffffffffb800ed9

 11  19157                      core:return                 1

write_elfnotes() iterates over all fds and gets an EIO. zfs_lookup() immediately returns EIO because z_sa_hdl is NULL. Maybe the fix is to continue the fd loop in write_elfnotes() instead of leaving the function:

http://src.illumos.org/source/xref/illumos-gate/usr/src/uts/common/exec/elf/elf_notes.c#383