From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6509D3B6BEB; Wed, 29 Apr 2026 08:42:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777452142; cv=none; b=VY02xLtJW1Nq3bskmgxbWhuLrjpeaooChK94Fh8M9rcsk/U1A70OP7xELPWJO8q6Z5ySI0do18RPSAWONwkmSNTu2SHqN0pxJLBzRFGjQiayoyklQo/oICMiLuzJVPDnnxozo2oWKeLCPu1+ON03/jtbiVATDKySLAP2F7LjyBc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777452142; c=relaxed/simple; bh=t7kSSrP3dnf/fxojWIQ7BrwwsPqrfP6Uq/dJpl/ryJM=; h=Date:From:To:Cc:Subject:Message-Id:In-Reply-To:References: Mime-Version:Content-Type; b=fa0GFfgG8wcAMLsKCVi4nw7Lw66+58VdkxheWyuSixvGMMvw87gzZSsd9VEJYAFmpUkJeaQfK74I7ifPqHsBcx9ylin9uEYVnnV/C4SCQtDDTo6bTqKFm0EKWoWvngd571coXiHLk6Ewlo3RcY1Z6sp5pfTA9NEicqL2SMsC5g8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=ME2PcfkF; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="ME2PcfkF" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5070EC19425; Wed, 29 Apr 2026 08:42:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1777452141; bh=t7kSSrP3dnf/fxojWIQ7BrwwsPqrfP6Uq/dJpl/ryJM=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=ME2PcfkFZfU1i4Dx7wd4PioBRya3Oayl2roa5ohq/bwtJcPfTNkbOm2HfVckNqejl ofkMcP0AcnoBpo4oW2CU86ACtdHkRAELs1SC9mulOnlRwPqH1/0fzgeoTBLK77f8vT J0eL7zjUpXNXOSpthfWaTsqUpV3AptZWkG8deP8nl53hjs3//bDH85Tk2qm6Yhaw8a mfnyTEzMmUkziVQp13/Zt1RLd4GB4S5Mcuj4wpKht9/Xr1XpT4YFXuMYvKBaxdjcTh m9eQBqaWIBHDaZSUcVfg9yKZE3NtFuqtTuMmT7+CANq17/VhNBrJeV+BnEmKEuT2kF JAV0+Yw2HrvoQ== Date: Wed, 29 Apr 2026 17:42:18 +0900 From: Masami Hiramatsu (Google) To: Steven Rostedt Cc: LKML , Linux Trace Kernel , Masami Hiramatsu , Mathieu Desnoyers Subject: Re: [PATCH] tracing/probes: Limit size of event probe to 3K Message-Id: <20260429174218.97dd03b66db5df6a7eea8d83@kernel.org> In-Reply-To: <20260428122302.706610ba@gandalf.local.home> References: <20260428122302.706610ba@gandalf.local.home> X-Mailer: Sylpheed 3.8.0beta1 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Tue, 28 Apr 2026 12:23:02 -0400 Steven Rostedt wrote: > From: Steven Rostedt > > There currently isn't a max limit an event probe can be. One could make an > event greater than PAGE_SIZE, which makes the event useless because if > it's bigger than the max event that can be recorded into the ring buffer, > then it will never be recorded. > > A event probe should never need to be greater than 3K, so make that the > max size. As long as the max is less than the max that can be recorded > onto the ring buffer, it should be fine. This looks good to me. Acked-by: Masami Hiramatsu (Google) Thanks! > > Cc: stable@vger.kernel.org > Fixes: 93ccae7a22274 ("tracing/kprobes: Support basic types on dynamic events") > Signed-off-by: Steven Rostedt > --- > kernel/trace/trace_probe.c | 6 ++++++ > kernel/trace/trace_probe.h | 4 +++- > 2 files changed, 9 insertions(+), 1 deletion(-) > > diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c > index e1c73065dae5..e0d3a0da26af 100644 > --- a/kernel/trace/trace_probe.c > +++ b/kernel/trace/trace_probe.c > @@ -1523,6 +1523,12 @@ static int traceprobe_parse_probe_arg_body(const char *argv, ssize_t *size, > parg->offset = *size; > *size += parg->type->size * (parg->count ?: 1); > > + if (*size > MAX_PROBE_EVENT_SIZE) { > + ret = -E2BIG; > + trace_probe_log_err(ctx->offset, EVENT_TOO_BIG); > + goto fail; > + } > + > if (parg->count) { > len = strlen(parg->type->fmttype) + 6; > parg->fmt = kmalloc(len, GFP_KERNEL); > diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h > index 9fc56c937130..262d8707a3df 100644 > --- a/kernel/trace/trace_probe.h > +++ b/kernel/trace/trace_probe.h > @@ -38,6 +38,7 @@ > #define MAX_BTF_ARGS_LEN 128 > #define MAX_DENTRY_ARGS_LEN 256 > #define MAX_STRING_SIZE PATH_MAX > +#define MAX_PROBE_EVENT_SIZE 3072 > > /* Reserved field names */ > #define FIELD_STRING_IP "__probe_ip" > @@ -561,7 +562,8 @@ extern int traceprobe_define_arg_fields(struct trace_event_call *event_call, > C(BAD_TYPE4STR, "This type does not fit for string."),\ > C(NEED_STRING_TYPE, "$comm and immediate-string only accepts string type"),\ > C(TOO_MANY_ARGS, "Too many arguments are specified"), \ > - C(TOO_MANY_EARGS, "Too many entry arguments specified"), > + C(TOO_MANY_EARGS, "Too many entry arguments specified"), \ > + C(EVENT_TOO_BIG, "Event too big (too many fields?)"), > > #undef C > #define C(a, b) TP_ERR_##a > -- > 2.53.0 > -- Masami Hiramatsu (Google)