From ad24635d567cba24434a5cf41a8cfd5520c6ad3f Mon Sep 17 00:00:00 2001 From: kromych Date: Wed, 18 Sep 2024 20:16:45 -0700 Subject: [PATCH] Heuristic to increase chances of resolvng the stack As it stands, the code sorts the VA region by the start address. That is neither required nor beneficial besides the aesthetic appeal of the `objdump` output. When the system is under stress and might OOM, or the program whose core dump is being captured might be terminated by some watchdog, it should be preferred to save the smaller regions of the VA space first as these are more likely to have the stack memory as opposed to the heap. As for the OOM argument, if the memory being read was paged out, reading it brings it back from the swap file increasing the memory pressure and increasing the chances of OOM-ing the system as Linux overcommits by default. That said, saving the smaller VA regions first likely helps to captre more and likely the stack memory. Sort the VA regioon by the size increasing to have better chances of capturing the stack memory before the program goes away. For validation, captured core dump files of the large VS code server processes. the debuggers could open the dump file, and the stacks came in before the heap memory. --- elfcore/src/coredump.rs | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/elfcore/src/coredump.rs b/elfcore/src/coredump.rs index b7712c5..b1e588c 100644 --- a/elfcore/src/coredump.rs +++ b/elfcore/src/coredump.rs @@ -630,7 +630,21 @@ fn get_va_regions(pid: Pid) -> Result<(Vec, Vec, u64), Cor }); } - maps.sort_by_key(|x| x.begin); + // When the system is under stress and might OOM, or the program + // whose core dump is being captured might be terminated by some + // watchdog, it should be preferred to save the smaller regions of the + // VA space first as these are more likely to have the stack memory + // as opposed to the heap. + // + // As for the OOM argument, if the memory being read was paged + // out, reading it brings it back from the swap file increasing the memory + // pressure and increasing the chances of OOM-ing the system as + // Linux overcommits by default. That said, saving the smaller VA + // regions first likely helps to captre more and likely the stack memory. + // + // Sort the VA regioon by the size increasing to have better chances of + // capturing the stack memory before the program goes away. + maps.sort_by_key(|x| x.end - x.begin); Ok((maps, mapped_files, vdso)) }