Re: [PATCH] uprobe: avoid out-of-bounds memory access of fetching args

[Oleg Nesterov]

Sorry, currently I don't have time to even try to read this patch, just
one note below...

On 10/14, Ma Qiao wrote:
>
> @@ -979,6 +980,11 @@ static struct uprobe_cpu_buffer *prepare_uprobe_buffer(struct trace_uprobe *tu,
>  	ucb = uprobe_buffer_get();
>  	ucb->dsize = tu->tp.size + dsize;
>  
> +	if (WARN_ON_ONCE(ucb->dsize > MAX_UCB_BUFFER_SIZE)) {
> +		ucb->dsize = MAX_UCB_BUFFER_SIZE;
> +		dsize = MAX_UCB_BUFFER_SIZE - tu->tp.size;
> +	}
> +

Then you can probably kill the

	if (WARN_ON_ONCE(ucb->dsize > PAGE_SIZE))

check in __uprobe_trace_func(), no?

Oleg.