Re: [PATCH v2] tracing: eprobe: read the complete FILTER_PTR_STRING pointer

[Masami Hiramatsu (Google) <mhiramat@kernel.org>]

On Sat, 20 Jun 2026 16:48:59 +0200
Martin Kaiser <martin@kaiser.cx> wrote:

> For a char * element in an event, the FILTER_PTR_STRING filter type is
> used. When the event occurs, a pointer is stored in the ringbuffer.
> 
> If an eprobe references such a char * element of a "base event", the
> stored pointer is truncated when it's read from the ringbuffer.
> 
> $ cd /sys/kernel/tracing
> $ echo 'e rcu.rcu_utilization $s:x64 $s:string' > dynamic_events
> $ echo 1 > tracing_on
> $ echo 1 > events/eprobes/enable
> $ sleep 1
> $ echo 0 > events/eprobes/enable
> $ cat trace
>    <idle>-0  ...: (rcu.rcu_utilization) arg1=0x4f arg2=(fault)
>    <idle>-0  ...: (rcu.rcu_utilization) arg1=0x2 arg2=(fault)
> 
> The problem is in get_event_field
> 
> 	val = (unsigned long)(*(char *)addr);
> 
> addr points to the position in the ringbuffer where the pointer was
> stored. The assignment reads only the lowest byte of the pointer.
> 
> Fix the cast to read the whole pointer. The output of the test above
> is now
> 
> <idle>-0 ... arg1=0xffffffff81c7d3f3 arg2="Start scheduler-tick"
> <idle>-0 ... arg1=0xffffffff81c57340 arg2="End scheduler-tick"

This looks good to me. Let me pick it.

Thanks!

> 
> Fixes: f04dec93466a ("tracing/eprobes: Fix reading of string fields")
> Signed-off-by: Martin Kaiser <martin@kaiser.cx>
> ---
> v2
>  - use rcu event as an example, don't dereference a user pointer
>  - add Fixes tag
> 
>  kernel/trace/trace_eprobe.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/kernel/trace/trace_eprobe.c b/kernel/trace/trace_eprobe.c
> index b66d6196338d..50518b071414 100644
> --- a/kernel/trace/trace_eprobe.c
> +++ b/kernel/trace/trace_eprobe.c
> @@ -315,7 +315,7 @@ get_event_field(struct fetch_insn *code, void *rec)
>  			val = (unsigned long)addr;
>  			break;
>  		case FILTER_PTR_STRING:
> -			val = (unsigned long)(*(char *)addr);
> +			val = *(unsigned long *)addr;
>  			break;
>  		default:
>  			WARN_ON_ONCE(1);
> -- 
> 2.43.7
> 


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>