Hi Daisuke,<br><br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="gmail_quote"><div>I also did a test for first load gcore module, and then load the test file symbol.</div>
<div>This time, there would be no &quot;<span style="color:rgb(80,0,80);font-size:13px;font-family:arial,sans-serif">invalid structure member offset</span>&quot; error.</div>
<div>But it would result another issue:</div><div><div>gcore: Restoring the thread group ... </div><div>gcore: done.</div><div>gcore: Retrieving note information ... </div><div>gcore: invalid kernel virtual address: 30a  type: &quot;__task_pid_nr_ns: pids_type_pid&quot;</div>

</div><div><br></div><div>As you said, the cached symbols are not affected, so why I load the test file</div><div>symbol later behavior would still cause gcore failure? Seems weird...</div><div><br></div></div></blockquote>
<div><br></div><div>Finally I find the reason why load module first still has issue...</div><div>For task_struct/group_leader, gcore still use the MEMBER_OFFSET, so it would try</div><div>to get this member offset each time instead of using the cached one.</div>
<div>Then if the symbol is changed by like user space, the gcore would be directly confused.</div><div><br></div><div>Here is a fix for it.</div><div>diff --git a/extensions/libgcore/gcore_coredump_table.c b/extensions/libgcore/gcore_coredump_table.c</div>
<div>index 2ae64df..e18f4c8 100644</div><div>--- a/extensions/libgcore/gcore_coredump_table.c</div><div>+++ b/extensions/libgcore/gcore_coredump_table.c</div><div>@@ -229,8 +229,7 @@ __task_pid_nr_ns(ulong task, enum pid_type type)</div>
<div>                ulong pids_type_pid;</div><div> </div><div>                 if (type != PIDTYPE_PID)</div><div>-                       readmem(task + MEMBER_OFFSET(&quot;task_struct&quot;,</div><div>-                                                    &quot;group_leader&quot;),</div>
<div>+                       readmem(task + GCORE_OFFSET(task_struct_group_leader),</div><div>                                KVADDR, &amp;task, sizeof(ulong),</div><div>                                &quot;__task_pid_nr_ns: group_leader&quot;,</div>
<div>                                gcore_verbose_error_handle()); </div><div><br></div><div>Thanks,</div><div>Lei</div></div>