@@ -179,18 +179,20 @@ fn read_kernel_code(addr: u64, size: usize) -> Result<Vec<u8>> {
179179fn read_kernel_code_from_kcore ( file : & mut File , addr : u64 , size : usize ) -> Result < Vec < u8 > > {
180180 use object:: { elf, read:: elf:: FileHeader , Endianness } ;
181181
182- // Read the ELF header and program headers first.
183- // Note: /proc/kcore is a virtual file representing kernel memory as an ELF core dump.
184- // The ELF header starts at offset 0 and is always present (typically 64 bytes for ELF64).
185- // The program headers follow immediately after and are also always present.
186- // A 4096-byte initial read is sufficient for the header area since:
187- // - ELF64 header is 64 bytes
188- // - Each program header is 56 bytes, and typical kernels have < 70 segments
189- // - Total header area rarely exceeds 4KB
190- // EOF will not occur here as /proc/kcore always provides this data when readable.
182+ // Read the ELF header and program headers from /proc/kcore.
183+ // We attempt to read 4096 bytes which is usually enough for the ELF64 header (64 bytes)
184+ // plus program headers (56 bytes each). If the initial read is insufficient (e.g., many
185+ // memory segments), the code below will resize and re-read as needed.
191186 file. seek ( SeekFrom :: Start ( 0 ) ) ?;
192187 let mut header_data = vec ! [ 0u8 ; 4096 ] ;
193- file. read_exact ( & mut header_data) ?;
188+ let n = file. read ( & mut header_data) ?;
189+ if n < 64 {
190+ return Err ( Error :: Msg ( format ! (
191+ "Failed to read kcore ELF header: only got {} bytes" ,
192+ n
193+ ) ) ) ;
194+ }
195+ header_data. truncate ( n) ;
194196
195197 // Parse header to get program header info
196198 let ( endian, phoff, phnum, phentsize) = {
0 commit comments