From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from akranes.kaiser.cx (akranes.kaiser.cx [152.53.16.207]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1B2CC4A33; Sat, 20 Jun 2026 14:54:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=152.53.16.207 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781967254; cv=none; b=qA0WoO9Y4M4ZnmQma5YOQpU1Q8CphQNQBZ8Jde5dudKCUXxBB1rHIdwIYukEIrv0WesnR/1YtF7to4KqUnBdAwB4VpQ5EpdTTqOm9958YHZTiBlJ2ti50J1e+WN5Qv27dxGVo13ZvHS6yTcOd+MtTL95cEEsmHOdKackBs8/ElU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781967254; c=relaxed/simple; bh=WHuJMQWJshtAoo4njYufZbh3gQrGBPEfude2fm3Qwvs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=uT50zSNYXCPcHuzynUZrJMl+M55muXkmabUw2buuRE7idqclfy6QNF+UWbGUW75/WmTX6Cd2O44rqCEH6yV6+RcN/t+gPYUC8wVkYcxGrdprEUElNsmiKK0eDtd/wuf9ELgJNphzHZ9jWkpoZehrHHVA9B5OIBXH3uBk/8moPPw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=kaiser.cx; spf=pass smtp.mailfrom=kaiser.cx; arc=none smtp.client-ip=152.53.16.207 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=kaiser.cx Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kaiser.cx Received: from ipservice-092-209-184-216.092.209.pools.vodafone-ip.de ([92.209.184.216] helo=nb282.user.codasip.com) by akranes.kaiser.cx with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.98.2) (envelope-from ) id 1wax56-00000001cvM-3I5V; Sat, 20 Jun 2026 16:54:00 +0200 From: Martin Kaiser To: Steven Rostedt , Masami Hiramatsu Cc: linux-trace-kernel@vger.kernel.org, linux-kernel@vger.kernel.org, Martin Kaiser Subject: [PATCH v2] tracing: eprobe: read the complete FILTER_PTR_STRING pointer Date: Sat, 20 Jun 2026 16:48:59 +0200 Message-ID: <20260620145339.3234726-1-martin@kaiser.cx> X-Mailer: git-send-email 2.43.7 Precedence: bulk X-Mailing-List: linux-trace-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit For a char * element in an event, the FILTER_PTR_STRING filter type is used. When the event occurs, a pointer is stored in the ringbuffer. If an eprobe references such a char * element of a "base event", the stored pointer is truncated when it's read from the ringbuffer. $ cd /sys/kernel/tracing $ echo 'e rcu.rcu_utilization $s:x64 $s:string' > dynamic_events $ echo 1 > tracing_on $ echo 1 > events/eprobes/enable $ sleep 1 $ echo 0 > events/eprobes/enable $ cat trace -0 ...: (rcu.rcu_utilization) arg1=0x4f arg2=(fault) -0 ...: (rcu.rcu_utilization) arg1=0x2 arg2=(fault) The problem is in get_event_field val = (unsigned long)(*(char *)addr); addr points to the position in the ringbuffer where the pointer was stored. The assignment reads only the lowest byte of the pointer. Fix the cast to read the whole pointer. The output of the test above is now -0 ... arg1=0xffffffff81c7d3f3 arg2="Start scheduler-tick" -0 ... arg1=0xffffffff81c57340 arg2="End scheduler-tick" Fixes: f04dec93466a ("tracing/eprobes: Fix reading of string fields") Signed-off-by: Martin Kaiser --- v2 - use rcu event as an example, don't dereference a user pointer - add Fixes tag kernel/trace/trace_eprobe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/trace/trace_eprobe.c b/kernel/trace/trace_eprobe.c index b66d6196338d..50518b071414 100644 --- a/kernel/trace/trace_eprobe.c +++ b/kernel/trace/trace_eprobe.c @@ -315,7 +315,7 @@ get_event_field(struct fetch_insn *code, void *rec) val = (unsigned long)addr; break; case FILTER_PTR_STRING: - val = (unsigned long)(*(char *)addr); + val = *(unsigned long *)addr; break; default: WARN_ON_ONCE(1); -- 2.43.7