[PATCH v2] tracing: eprobe: read the complete FILTER_PTR_STRING pointer

[PATCH v2] tracing: eprobe: read the complete FILTER_PTR_STRING pointer

[Martin Kaiser]

For a char * element in an event, the FILTER_PTR_STRING filter type is
used. When the event occurs, a pointer is stored in the ringbuffer.

If an eprobe references such a char * element of a "base event", the
stored pointer is truncated when it's read from the ringbuffer.

$ cd /sys/kernel/tracing
$ echo 'e rcu.rcu_utilization $s:x64 $s:string' > dynamic_events
$ echo 1 > tracing_on
$ echo 1 > events/eprobes/enable
$ sleep 1
$ echo 0 > events/eprobes/enable
$ cat trace
   <idle>-0  ...: (rcu.rcu_utilization) arg1=0x4f arg2=(fault)
   <idle>-0  ...: (rcu.rcu_utilization) arg1=0x2 arg2=(fault)

The problem is in get_event_field

	val = (unsigned long)(*(char *)addr);

addr points to the position in the ringbuffer where the pointer was
stored. The assignment reads only the lowest byte of the pointer.

Fix the cast to read the whole pointer. The output of the test above
is now

<idle>-0 ... arg1=0xffffffff81c7d3f3 arg2="Start scheduler-tick"
<idle>-0 ... arg1=0xffffffff81c57340 arg2="End scheduler-tick"

Fixes: f04dec93466a ("tracing/eprobes: Fix reading of string fields")
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
---
v2
 - use rcu event as an example, don't dereference a user pointer
 - add Fixes tag

 kernel/trace/trace_eprobe.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/trace/trace_eprobe.c b/kernel/trace/trace_eprobe.c
index b66d6196338d..50518b071414 100644
--- a/kernel/trace/trace_eprobe.c
+++ b/kernel/trace/trace_eprobe.c
@@ -315,7 +315,7 @@ get_event_field(struct fetch_insn *code, void *rec)
 			val = (unsigned long)addr;
 			break;
 		case FILTER_PTR_STRING:
-			val = (unsigned long)(*(char *)addr);
+			val = *(unsigned long *)addr;
 			break;
 		default:
 			WARN_ON_ONCE(1);
-- 
2.43.7

Re: [PATCH v2] tracing: eprobe: read the complete FILTER_PTR_STRING pointer

[Masami Hiramatsu]

On Sat, 20 Jun 2026 16:48:59 +0200
Martin Kaiser <martin@kaiser.cx> wrote:

> For a char * element in an event, the FILTER_PTR_STRING filter type is
> used. When the event occurs, a pointer is stored in the ringbuffer.
> 
> If an eprobe references such a char * element of a "base event", the
> stored pointer is truncated when it's read from the ringbuffer.
> 
> $ cd /sys/kernel/tracing
> $ echo 'e rcu.rcu_utilization $s:x64 $s:string' > dynamic_events
> $ echo 1 > tracing_on
> $ echo 1 > events/eprobes/enable
> $ sleep 1
> $ echo 0 > events/eprobes/enable
> $ cat trace
>    <idle>-0  ...: (rcu.rcu_utilization) arg1=0x4f arg2=(fault)
>    <idle>-0  ...: (rcu.rcu_utilization) arg1=0x2 arg2=(fault)
> 
> The problem is in get_event_field
> 
> 	val = (unsigned long)(*(char *)addr);
> 
> addr points to the position in the ringbuffer where the pointer was
> stored. The assignment reads only the lowest byte of the pointer.
> 
> Fix the cast to read the whole pointer. The output of the test above
> is now
> 
> <idle>-0 ... arg1=0xffffffff81c7d3f3 arg2="Start scheduler-tick"
> <idle>-0 ... arg1=0xffffffff81c57340 arg2="End scheduler-tick"

This looks good to me. Let me pick it.

Thanks!

> 
> Fixes: f04dec93466a ("tracing/eprobes: Fix reading of string fields")
> Signed-off-by: Martin Kaiser <martin@kaiser.cx>
> ---
> v2
>  - use rcu event as an example, don't dereference a user pointer
>  - add Fixes tag
> 
>  kernel/trace/trace_eprobe.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/kernel/trace/trace_eprobe.c b/kernel/trace/trace_eprobe.c
> index b66d6196338d..50518b071414 100644
> --- a/kernel/trace/trace_eprobe.c
> +++ b/kernel/trace/trace_eprobe.c
> @@ -315,7 +315,7 @@ get_event_field(struct fetch_insn *code, void *rec)
>  			val = (unsigned long)addr;
>  			break;
>  		case FILTER_PTR_STRING:
> -			val = (unsigned long)(*(char *)addr);
> +			val = *(unsigned long *)addr;
>  			break;
>  		default:
>  			WARN_ON_ONCE(1);
> -- 
> 2.43.7
> 


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>