[BUG] tracing/uprobe: oversized dynamic ustring triggers WARN_ON_ONCE panic

[Yifei Chu]

Hello,

Short version: I can make trace_uprobe hit WARN_ON_ONCE() by creating an uprobe/uretprobe event with several dynamic ustring fetch args. With panic_on_warn=1, this becomes a reproducible panic.

The setup is pretty direct. The reproducers mount tracefs, create a trace event with several ustring arguments pointing at a 4095-byte userspace string, and then trigger the event. At probe hit time, the dynamic string sizes are accumulated and prepare_uprobe_buffer() sees a payload larger than MAX_UCB_BUFFER_SIZE/PAGE_SIZE:

WARN_ON_ONCE(ucb->dsize > MAX_UCB_BUFFER_SIZE)

I reproduced the same class through both uprobe and uretprobe events.

Tested environment:

Linux version 7.0.9, x86_64 QEMU
gcc 12.3.0, GNU ld 2.38
Boot args included: panic_on_warn=1 nokaslr console=ttyS0

Uprobe result:

WARNING: kernel/trace/trace_uprobe.c:982 at prepare_uprobe_buffer.part.0+0x458/0x5b0
Kernel panic - not syncing: kernel: panic_on_warn set …

Uretprobe result:

triggering uretprobe oversized ustring buffer at offset 0x1db0
WARNING: kernel/trace/trace_uprobe.c:982 at prepare_uprobe_buffer.part.0+0x458/0x5b0
uretprobe_dispatcher+0x328/0x3e0
Kernel panic - not syncing: kernel: panic_on_warn set …

I checked current mainline source and still see the runtime WARN path in kernel/trace/trace_uprobe.c. I have reproduced the panic on the 7.0.9 QEMU build above; I have not yet runtime-tested current mainline.

My expectation is that oversized user-controlled dynamic trace data should be rejected, capped, or dropped before it reaches a WARN invariant. A tracefs user should not be able to turn a long string fetch into a kernel warning/panic.

The attached tarball has README files, both C reproducers, and the full QEMU logs.

Thanks,
Chuyifei

Attachment: trace_uprobe_uretprobe_ustring_warn_panic.tar.gz
Description: Unix tar archive