Re: [PATCH] kprobes: Limit max data_size of the kretprobe instances

[Steven Rostedt]

On Wed,  1 Dec 2021 23:45:50 +0900
Masami Hiramatsu <mhiramat@xxxxxxxxxx> wrote:

> The kretprobe::data_size is unsigned (size_t) but it is
> used as 'data_size + sizeof(struct kretprobe_instance)'.
> Thus, it can be smaller than sizeof(struct kretprobe_instance)
> while allocating memory for the kretprobe_instance.

The above doesn't make sense.

data_size is unsigned but it is used as
 'data_size + sizeof(struct kretprobe_instance)'. 

What does that mean?

What can be smaller than sizeof(struct kretprobe_instance) and why does it
matter?

-- Steve


> 
> To avoid this issue, introduce a max limitation of the
> kretprobe::data_size. 4KB per instance should be OK.
>