[Bug 2109979] Re: max size of user coredump is 0x7ffff000

[Benjamin Drung]

** Tags added: good-first-issue

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to apport in Ubuntu.
https://bugs.launchpad.net/bugs/2109979

Title:
  max size of user coredump is 0x7ffff000

Status in Apport:
  Triaged
Status in apport package in Ubuntu:
  Triaged

Bug description:
  In the code there is a snippet from '/usr/share/apport/apport' on
  ubuntu 24.04:

  ```
      # Priming read
      if from_report:
  ...
          error_log('writing core dump %s of size %i' % (core_name, core_size))
          os.write(core_file, r['CoreDump'])
  ```

  Looking to the fact, that os.write is a low-level function, which is
  (most probably) came to write() function of the kernel (see 'man 2
  write'), we have following note in the manual:

  ```
  NOTES
  ...

         On Linux, write() (and similar system calls) will transfer at most 0x7ffff000 (2,147,479,552) bytes, returning the number of bytes actually transferred.  (This is true on both 32-bit and 64-bit systems.)
  ```

  The fact is that coredumps are limited by this number. When trying to
  catch bigger one, we have file sized exactly 0x7ffff000 bytes; and
  they're trunked (i.e. recognized as damaged by gdb) with this default.

To manage notifications about this bug go to:
https://bugs.launchpad.net/apport/+bug/2109979/+subscriptions