On Sun, 24 May 2026 10:44:09 -0400 Yifei Chu <[email protected]> wrote:
> Hello, > > Short version: I can make trace_uprobe hit WARN_ON_ONCE() by creating an > uprobe/uretprobe event with several dynamic ustring fetch args. With > panic_on_warn=1, this becomes a reproducible panic. > > The setup is pretty direct. The reproducers mount tracefs, create a trace > event with several ustring arguments pointing at a 4095-byte userspace > string, and then trigger the event. At probe hit time, the dynamic string > sizes are accumulated and prepare_uprobe_buffer() sees a payload larger > than MAX_UCB_BUFFER_SIZE/PAGE_SIZE: > > WARN_ON_ONCE(ucb->dsize > MAX_UCB_BUFFER_SIZE) > > I reproduced the same class through both uprobe and uretprobe events. This should be fixed by [1] [1] https://lore.kernel.org/all/[email protected]/ Thanks, > > Tested environment: > > Linux version 7.0.9, x86_64 QEMU > gcc 12.3.0, GNU ld 2.38 > Boot args included: panic_on_warn=1 nokaslr console=ttyS0 > > Uprobe result: > > WARNING: kernel/trace/trace_uprobe.c:982 at > prepare_uprobe_buffer.part.0+0x458/0x5b0 > Kernel panic - not syncing: kernel: panic_on_warn set … > > Uretprobe result: > > triggering uretprobe oversized ustring buffer at offset 0x1db0 > WARNING: kernel/trace/trace_uprobe.c:982 at > prepare_uprobe_buffer.part.0+0x458/0x5b0 > uretprobe_dispatcher+0x328/0x3e0 > Kernel panic - not syncing: kernel: panic_on_warn set … > > I checked current mainline source and still see the runtime WARN path in > kernel/trace/trace_uprobe.c. I have reproduced the panic on the 7.0.9 QEMU > build above; I have not yet runtime-tested current mainline. > > My expectation is that oversized user-controlled dynamic trace data should > be rejected, capped, or dropped before it reaches a WARN invariant. A > tracefs user should not be able to turn a long string fetch into a kernel > warning/panic. > > The attached tarball has README files, both C reproducers, and the full > QEMU logs. > > Thanks, > Chuyifei -- Masami Hiramatsu (Google) <[email protected]>
