tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

tracing/probes: Limit size of event probe to 3K

There currently isn't a max limit an event probe can be. One could make an
event greater than PAGE_SIZE, which makes the event useless because if
it's bigger than the max event that can be recorded into the ring buffer,
then it will never be recorded.

A event probe should never need to be greater than 3K, so make that the
max size. As long as the max is less than the max that can be recorded
onto the ring buffer, it should be fine.

Cc: stable@vger.kernel.org
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Fixes: 93ccae7a22274 ("tracing/kprobes: Support basic types on dynamic events")
Link: https://patch.msgid.link/20260428122302.706610ba@gandalf.local.home
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

Steven Rostedt b2aa3b4d 5ec07d52

+9 -1
+6
kernel/trace/trace_probe.c
··· 1523 1523 parg->offset = *size; 1524 1524 *size += parg->type->size * (parg->count ?: 1); 1525 1525 1526 + if (*size > MAX_PROBE_EVENT_SIZE) { 1527 + ret = -E2BIG; 1528 + trace_probe_log_err(ctx->offset, EVENT_TOO_BIG); 1529 + goto fail; 1530 + } 1531 + 1526 1532 if (parg->count) { 1527 1533 len = strlen(parg->type->fmttype) + 6; 1528 1534 parg->fmt = kmalloc(len, GFP_KERNEL);
+3 -1
kernel/trace/trace_probe.h
··· 38 38 #define MAX_BTF_ARGS_LEN 128 39 39 #define MAX_DENTRY_ARGS_LEN 256 40 40 #define MAX_STRING_SIZE PATH_MAX 41 + #define MAX_PROBE_EVENT_SIZE 3072 41 42 42 43 /* Reserved field names */ 43 44 #define FIELD_STRING_IP "__probe_ip" ··· 562 561 C(BAD_TYPE4STR, "This type does not fit for string."),\ 563 562 C(NEED_STRING_TYPE, "$comm and immediate-string only accepts string type"),\ 564 563 C(TOO_MANY_ARGS, "Too many arguments are specified"), \ 565 - C(TOO_MANY_EARGS, "Too many entry arguments specified"), 564 + C(TOO_MANY_EARGS, "Too many entry arguments specified"), \ 565 + C(EVENT_TOO_BIG, "Event too big (too many fields?)"), 566 566 567 567 #undef C 568 568 #define C(a, b) TP_ERR_##a