coredump: when reconstructing original kernel coredump context, chop off trailing...

Our coredump handler operates on a "context" supplied by the kernel via
the core_pattern arguments. When we pass off a coredump for processing
to coredumpd we pass along enough information for this context to be
reconstructed. This information is passed in the usual journal fields,
and that means we extended the 1s granularity timestamp to 1µs
granularity by appending 6 zeroes. We need to chop them off again when
reconstructing the original kernel context.

Fixes: #4779

diff --git a/src/coredump/coredump.c b/src/coredump/coredump.c
index 738061bffccfb4ef4d43633d0996a4fed6ffdc75..c1827d764ef205487e84555b3a9657a506d46acc 100644 (file)
--- a/src/coredump/coredump.c
+++ b/src/coredump/coredump.c
@@ -821,7 +821,7 @@ static void map_context_fields(const struct iovec *iovec, const char *context[])
 static int process_socket(int fd) {
         _cleanup_close_ int coredump_fd = -1;
         struct iovec *iovec = NULL;
-        size_t n_iovec = 0, n_allocated = 0, i;
+        size_t n_iovec = 0, n_allocated = 0, i, k;
         const char *context[_CONTEXT_MAX] = {};
         int r;
 
@@ -925,6 +925,13 @@ static int process_socket(int fd) {
         assert(context[CONTEXT_COMM]);
         assert(coredump_fd >= 0);
 
+        /* Small quirk: the journal fields contain the timestamp padded with six zeroes, so that the kernel-supplied 1s
+         * granularity timestamps becomes 1µs granularity, i.e. the granularity systemd usually operates in. Since we
+         * are reconstructing the original kernel context, we chop this off again, here. */
+        k = strlen(context[CONTEXT_TIMESTAMP]);
+        if (k > 6)
+                context[CONTEXT_TIMESTAMP] = strndupa(context[CONTEXT_TIMESTAMP], k - 6);
+
         r = submit_coredump(context, iovec, n_allocated, n_iovec, coredump_fd);
 
 finish: