kern/59045: kernel might write broken core files

[martin%NetBSD.org@localhost]

>Number:         59045
>Category:       kern
>Synopsis:       kernel might write broken core files
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Feb 03 11:50:00 +0000 2025
>Originator:     Martin Husemann
>Release:        NetBSD 10.99.12
>Organization:
The NetBSD Foundation, Inc.
>Environment:
System: NetBSD seven-days-to-the-wolves.aprisoft.de 10.99.12 NetBSD 10.99.12 (GENERIC) #771: Thu Jan 30 09:04:03 CET 2025 martin%seven-days-to-the-wolves.aprisoft.de@localhost:/work/src/sys/arch/amd64/compile/GENERIC amd64
Architecture: x86_64
Machine: amd64
>Description:

(machine and arch are bogus, I am looking at a evbarmv5 core file form /bin/sh
in -current)

cross-gdb complained about a core file:

GNU gdb (GDB) 15.1
[..]
This GDB was configured as "--host=x86_64-unknown-netbsd10.99 --target=arm--netbsdelf-eabi".
[..]
(gdb) set sysroot /branches/hosts-current/evbearmv5/  
(gdb) set debug-file-directory //branches/hosts-current/evbearmv5/usr/libdata/debug/
(gdb) file /branches/hosts-current/evbearmv5/bin/sh 
Reading symbols from /branches/hosts-current/evbearmv5/bin/sh...
Reading symbols from //branches/hosts-current/evbearmv5/usr/libdata/debug//bin/sh.debug...
(gdb) target core sh.core 
warning: BFD: warning: /tmp/sh.core has a segment extending past end of file
[New process 11128]
Core was generated by `sh'.
Program terminated with signal SIGBUS, Bus error.
#0  0xbbef4f64 in ?? ()
(gdb) bt
#0  0xbbef4f64 in ?? ()
#1  0xbbef5434 in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)


The BFD warning made me curious:

$ file sh.core 
sh.core: ELF 32-bit LSB core file, ARM, EABI5 version 1 (SYSV), NetBSD-style, from 'sh', pid=11128, uid=0, gid=0, nlwps=1, lwp=11128 (signal 10/code 32767)
$ ls -l sh.core
-rw-r--r--  1 martin  wheel    122880 Feb  3 11:54 sh.core
$ readelf --segments sh.core

Elf file type is CORE (Core file)
Entry point 0x0
There are 26 program headers, starting at offset 52

Program Headers:
  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align
  LOAD           0x000abc 0x00001000 0x00000000 0x00000 0x33000 R E 0x1000
  LOAD           0x000abc 0x00034000 0x00000000 0x00eb0 0x02000 RW  0x1000
  LOAD           0x00196c 0x00036000 0x00000000 0x008c4 0x01000 RW  0x1000
  LOAD           0x002230 0xbbc95000 0x00000000 0x00000 0x1e3000 R E 0x1000
  LOAD           0x002230 0xbbe78000 0x00000000 0x0b444 0x0c000 RW  0x1000
  LOAD           0x00d674 0xbbe84000 0x00000000 0x00000 0x02000 RW  0x1000
  LOAD           0x00d674 0xbbe86000 0x00000000 0x02218 0x13000 RW  0x1000
  LOAD           0x00f88c 0xbbe99000 0x00000000 0x00e64 0x02000 RW  0x1000
  LOAD           0x0106f0 0xbbe9b000 0x00000000 0x00000 0x01000 R   0x1000
  LOAD           0x0106f0 0xbbe9c000 0x00000000 0x03250 0x0a000 RW  0x1000
  LOAD           0x013940 0xbbea6000 0x00000000 0x00000 0x0d000 R E 0x1000
  LOAD           0x013940 0xbbeb3000 0x00000000 0x0110c 0x02000 RW  0x1000
  LOAD           0x014a4c 0xbbeb5000 0x00000000 0x00000 0x01000 R   0x1000
  LOAD           0x014a4c 0xbbeb6000 0x00000000 0x00000 0x29000 R E 0x1000
  LOAD           0x014a4c 0xbbedf000 0x00000000 0x014bc 0x02000 RW  0x1000
  LOAD           0x015f08 0xbbee1000 0x00000000 0x00000 0x02000 RW  0x1000
  LOAD           0x015f08 0xbbee3000 0x00000000 0x00000 0x01000 R   0x1000
  LOAD           0x015f08 0xbbee4000 0x00000000 0x065f4 0x08000 RW  0x1000
  LOAD           0x01c4fc 0xbbeec000 0x00000000 0x00000 0x11000 R E 0x1000
  LOAD           0x01c4fc 0xbbefd000 0x00000000 0x01000 0x01000 RW  0x1000
  LOAD           0x01d4fc 0xbbefe000 0x00000000 0x00ca4 0x01000 RW  0x1000
  LOAD           0x01e1a0 0xbbeff000 0x00000000 0x00000 0x3d00000     0x1000
  LOAD           0x01e1a0 0xbfbff000 0x00000000 0x00000 0x3f1000 RW  0x1000
  LOAD           0x01e1a0 0xbfff0000 0x00000000 0x00000 0x0d000 RW  0x1000
  LOAD           0x01e1a0 0xbfffd000 0x00000000 0x02000 0x02000 RW  0x1000
  NOTE           0x000374 0x00000000 0x00000000 0x00748 0x00000 R   0x4

If I add that correctly file offset 0x01e1a0 + file size 0x02000
is 0x0201a0 = 131488 which is beyound the file size 122880.

>How-To-Repeat:
Try to run /bin/sh on evbearmv5 after recent jemalloc version switch.

>Fix:
n/a