# kretprobe perf oversized dynamic ustring WARN/panic

## Issue

`trace_kprobe.c:kretprobe_perf_func()` computes the perf sample size from
user-defined dynamic fetch arguments:

- `dsize = __get_data_size(&tk->tp, regs, ri->data)`
- `size = sizeof(*entry) + tk->tp.size + dsize`
- `entry = perf_trace_buf_alloc(size, NULL, &rctx)`

`perf_trace_buf_alloc()` treats `size > PERF_MAX_TRACE_SIZE` as an invariant
violation and calls `WARN_ONCE()`.  A kretprobe with several immediate
`ustring` args pointing at one 4095-byte userspace string can drive the size
above the 8192-byte perf trace buffer.

With `panic_on_warn=1`, this is a deterministic kernel panic.

## Validation

QEMU command used:

```sh
timeout 90 qemu-system-x86_64 -m 1024M -smp 4 \
  -kernel linux-7.0.9-work/arch/x86/boot/bzImage \
  -initrd kretprobe_perf_initramfs.cpio \
  -append "console=ttyS0 earlyprintk=serial nokaslr panic=-1 panic_on_warn=1 init=/init" \
  -nographic -no-reboot | tee kretprobe_perf-validation3.log
```

Key log lines:

```text
triggering kretprobe perf oversized ustring event id 1690
perf buffer not large enough, wanted 16428, have 8192
WARNING: kernel/trace/trace_event_perf.c:405 at perf_trace_buf_alloc+0x111/0x160
kretprobe_perf_func+0x24b/0x750
Kernel panic - not syncing: kernel: panic_on_warn set ...
```

## Artifacts

- Reproducer: `repro.c`
- QEMU log: `qemu.log`
