Why and how does Linux kernel create a sparse file for the coredump?

Question

Currently I'm working on Linux 4.0.6. After a coredump activation, I observe that the generated corefiles is created as sparse files. For example, the ls command shows the size of my corefile is 42 MB. However, the du command shows that it allocates only 26.3 MB.

My questions regarding this observations:

1. Why does Linux kernel create a sparse file for the coredump?
2. How does it work? Does it depend on the filesystem where the coredump is placed?
3. Can I configure the system/ kernel to prevent the coredump as a sparse file?

Answer 1

You should just think of what a coredump file is: a mere sequential write of the memory of the process. On modern OS, the memory is not a simple sequential byte range, but can be made of multiple segments mapped at different addresses. That explains that if you try to read or write at an address outside of a mapped segment you get a Segment Violation Signal (SIGSEGV).

So at dump time, the system writes the segments in ascending order and just lseek to the beginning of each new segment thus building a sparse file.

Now for your questions:

1. Why does Linux kernel create a sparse file for the coredump?

The explanation is just above.

2. How does it work? Does it depend on the filesystem where the coredump is placed?

Not really, unless the underlying file system does not allow sparse files.

3. Can I configure the system/ kernel to prevent the coredump as a sparse file?

IMHO you cannot, and more you do not want to. The ls command gives you the higher memory address used by the program, while the du command gives you the total memory size used by the program, because unused addresses are not mapped and do not consume memory at all.