[Bug uprobes/34301] New: user string copy fault -14...near 'user_string_n' at /usr/share/systemtap/tapset/uconversions.stp:128:10
mike_itguy at Yahoo dot co.uk
sourceware-bugzilla@sourceware.org
Thu Jun 18 17:00:18 GMT 2026
https://sourceware.org/bugzilla/show_bug.cgi?id=34301
Bug ID: 34301
Summary: user string copy fault -14...near 'user_string_n' at
/usr/share/systemtap/tapset/uconversions.stp:128:10
Product: systemtap
Version: unspecified
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: uprobes
Assignee: systemtap at sourceware dot org
Reporter: mike_itguy at Yahoo dot co.uk
Target Milestone: ---
Environment: systemtap 5.6(pre-release) on ubuntu 24.04.4 LTS x64, probing
userland PHP running under Apache 2.4. which is running WordPress (i.e. PHP
8.3.31 built with suport for dtrace ). The gcc is 13.3 for building PHP and
systemtap.
My probes are trivial – they focus on PHP function entry/exit, they filter out
WordPress plugins that are not of interest, and they only print the arguments
that are available at the static probe points, as defined in the PHP manual
online.
#! /usr/bin/env stap
@define libphp8 %( "/usr/lib/apache2/modules/libphp.so" %)
probe process(@libphp8).mark("request__startup") {
printf("==> , %s , %s , %s \n", user_string($arg3), user_string($arg2),
user_string($arg1));
}
probe process(@libphp8).mark("request__shutdown") {
printf("<== , %s , %s ,%s \n", user_string($arg3), user_string($arg2),
user_string($arg1));
}
probe process(@libphp8).mark("function__entry") {
wp_filename=user_string($arg2)
if ( wp_filename !~ "wp-content\/plugins\/goc" ) next
if ( wp_filename =~ "wp-content\/plugins\/goc/vendor" ) next
printf(">> , %s, %s, %s , %d \n", user_string($arg4), user_string($arg1),
wp_filename, user_int($arg3) )
}
probe process(@libphp8).mark("function__return") {
wp_filename=user_string($arg2)
if ( wp_filename !~ "wp-content\/plugins\/goc" ) next
if ( wp_filename =~ "wp-content\/plugins\/goc/vendor" ) next
printf("<< , %s, %s, %s , %d \n", user_string($arg4), user_string($arg1),
wp_filename, user_int($arg3) )
}
The error reported by stap is below:
ERROR: user string copy fault -14 at 0x796e41492d38 [man error::fault] near
identifier 'user_string_n' at
/usr/share/systemtap/tapset/uconversions.stp:128:10
If I run stap `–suppress-handle-error` then I do not get the errors, but I
don’t know if that is safe or desirable. If I omit this option, it appears to
be random at what point the error will happen, but it reproduces 100% of the
time, sometimes before the browser can display even the login page of the
website, other times after login etc. The bare-metal machine has plenty of
RAM/CPU.
I don’t know if this type of fault is a feature of systemtap when probing
userland, or whether anything can be done to avoid it. Hence raising this
request.
The full stderr output is below:
# stap -vv /home/user1/goc_saved/goc_probes_02h.stp > /tmp/probe_logfile.txt
Created temporary directory "/tmp/stapzYw8OE"
Session arch: x86_64 release: 6.8.0-124-generic
Build tree: "/lib/modules/6.8.0-124-generic/build"
Kernel symbol table /lib/modules/6.8.0-124-generic/build/System.map
unavailable, (No such file or directory)
Searched for library macro files: "/usr/share/systemtap/tapset/linux", found:
7, processed: 7
Searched for library macro files: "/usr/share/systemtap/tapset", found: 11,
processed: 11
Searched for library macro files: "/usr/share/systemtap/tapset/linux", found:
7, processed: 0
Searched for library macro files: "/usr/share/systemtap/tapset", found: 11,
processed: 0
Searched: "/usr/share/systemtap/tapset/linux/x86_64", found: 20, processed: 20
Searched: "/usr/share/systemtap/tapset/linux", found: 413, processed: 413
Searched: "/usr/share/systemtap/tapset/x86_64", found: 1, processed: 1
Searched: "/usr/share/systemtap/tapset", found: 43, processed: 43
Searched: "/usr/share/systemtap/tapset/linux/x86_64", found: 20, processed: 0
Searched: "/usr/share/systemtap/tapset/linux", found: 413, processed: 0
Searched: "/usr/share/systemtap/tapset/x86_64", found: 1, processed: 0
Searched: "/usr/share/systemtap/tapset", found: 43, processed: 0
Pass 1: parsed user script and 495 library scripts using
3239800virt/124324res/12308shr/143992data kb, in 1290usr/1590sys/665real ms.
derive-probes (location #0):
process("/usr/lib/apache2/modules/libphp.so").mark("request__startup") of
keyword at /home/user1/goc_saved/goc_probes_02h.stp:8:1
derive-probes (location #0):
process("/usr/lib/apache2/modules/libphp.so").mark("request__shutdown") of
keyword at /home/user1/goc_saved/goc_probes_02h.stp:11:1
derive-probes (location #0):
process("/usr/lib/apache2/modules/libphp.so").mark("function__entry") of
keyword at /home/user1/goc_saved/goc_probes_02h.stp:17:1
derive-probes (location #0):
process("/usr/lib/apache2/modules/libphp.so").mark("function__return") of
keyword at /home/user1/goc_saved/goc_probes_02h.stp:26:1
Pass 2: analyzed script: 4 probes, 8 functions, 1 embed, 0 globals using
3242836virt/128560res/13432shr/147028data kb, in 20usr/0sys/24real ms.
function recursion-analysis: max-nesting 1 non-recursive
probe 0 ('process("/usr/lib/apache2/modules/libphp.so").statement(0x7a4cdb)')
locks nothing
4 statements for probe probe_6574
probe 1 ('process("/usr/lib/apache2/modules/libphp.so").statement(0x7a5501)')
locks nothing
4 statements for probe probe_6577
probe 2 ('process("/usr/lib/apache2/modules/libphp.so").statement(0x84342d)')
locks nothing
19 statements for probe probe_6580
probe 3 ('process("/usr/lib/apache2/modules/libphp.so").statement(0x84345e)')
locks nothing
19 statements for probe probe_6583
dump_unwindsyms /usr/lib/apache2/modules/libphp.so index=0 base=0x10000
Found build-id in /usr/lib/apache2/modules/libphp.so, length 20, start at 0x2d8
Pass 3: translated to C into
"/tmp/stapzYw8OE/stap_5beab801b56bb60db15f035b437ceb72_5512_src.c" using
3242964virt/128968res/13684shr/147156data kb, in 30usr/120sys/161real ms.
Pass 4: using cached
/root/.systemtap/cache/0e/stapconf_0e559852d6001ae44e5f10bd6e1feaaf_739.h
Running env -uARCH -uKBUILD_EXTMOD -uCROSS_COMPILE -uKBUILD_IMAGE
-uKCONFIG_CONFIG -uINSTALL_PATH -uLD_LIBRARY_PATH
PATH=/usr/bin:/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin
make -C /lib/modules/6.8.0-124-generic/build M=/tmp/stapzYw8OE modules
CONFIG_DEBUG_INFO= CONFIG_DEBUG_INFO_BTF_MODULES=
CONFIG_HAVE_UACCESS_VALIDATION= ARCH=x86_64 CC_VERSION_TEXT=foo
CONFIG_CC_VERSION_TEXT=foo PAHOLE_VERSION=0 CONFIG_PAHOLE_VERSION=0
--no-print-directory -j49
Spawn waitpid result (0x0): 0
Pass 4: compiled C into "stap_5beab801b56bb60db15f035b437ceb72_5512.ko" in
3350usr/1040sys/3966real ms.
Cache cleaning skipped, interval not reached 91 s / 300 s.
Copying /tmp/stapzYw8OE/stap_5beab801b56bb60db15f035b437ceb72_5512.ko to
/root/.systemtap/cache/5b/stap_5beab801b56bb60db15f035b437ceb72_5512.ko
Copying /tmp/stapzYw8OE/stap_5beab801b56bb60db15f035b437ceb72_5512_src.c to
/root/.systemtap/cache/5b/stap_5beab801b56bb60db15f035b437ceb72_5512.c
Copying /tmp/stapzYw8OE/stapconf_0e559852d6001ae44e5f10bd6e1feaaf_739.h to
/root/.systemtap/cache/0e/stapconf_0e559852d6001ae44e5f10bd6e1feaaf_739.h
Pass 5: starting run.
Running /usr/bin/staprun -v -R
/tmp/stapzYw8OE/stap_5beab801b56bb60db15f035b437ceb72_5512.ko
staprun:insert_module:191 Module stap_5beab801b56bb60db15f035b437ceb7_23147
inserted from file
/tmp/stapzYw8OE/stap_5beab801b56bb60db15f035b437ceb72_5512.ko
ERROR: user string copy fault -14 at 0x796e41492d38 [man error::fault] near
identifier 'user_string_n' at
/usr/share/systemtap/tapset/uconversions.stp:128:10
WARNING: Number of errors: 1, skipped probes: 0
stapio:cleanup_and_exit:285 detach=0
stapio:cleanup_and_exit:302 closing control channel
staprun:remove_module:292 Module stap_5beab801b56bb60db15f035b437ceb7_23147
removed.
Spawn waitpid result (0x100): 1
WARNING: /usr/bin/staprun exited with status: 1
Pass 5: run completed in 80usr/630sys/26818real ms.
Pass 5: run failed. [man error::pass5]
Running rm -rf /tmp/stapzYw8OE
Spawn waitpid result (0x0): 0
Removed temporary directory "/tmp/stapzYw8OE"
Let me know i I need to attach any other pertinent information.
--
You are receiving this mail because:
You are the assignee for the bug.
More information about the Systemtap
mailing list