On Sat, 20 Jun 2026 16:48:59 +0200
Martin Kaiser <[email protected]> wrote:
> For a char * element in an event, the FILTER_PTR_STRING filter type is
> used. When the event occurs, a pointer is stored in the ringbuffer.
>
> If an eprobe references such a char * element of a "base event", the
> stored pointer is truncated when it's read from the ringbuffer.
>
> $ cd /sys/kernel/tracing
> $ echo 'e rcu.rcu_utilization $s:x64 $s:string' > dynamic_events
> $ echo 1 > tracing_on
> $ echo 1 > events/eprobes/enable
> $ sleep 1
> $ echo 0 > events/eprobes/enable
> $ cat trace
> <idle>-0 ...: (rcu.rcu_utilization) arg1=0x4f arg2=(fault)
> <idle>-0 ...: (rcu.rcu_utilization) arg1=0x2 arg2=(fault)
>
> The problem is in get_event_field
>
> val = (unsigned long)(*(char *)addr);
>
> addr points to the position in the ringbuffer where the pointer was
> stored. The assignment reads only the lowest byte of the pointer.
>
> Fix the cast to read the whole pointer. The output of the test above
> is now
>
> <idle>-0 ... arg1=0xffffffff81c7d3f3 arg2="Start scheduler-tick"
> <idle>-0 ... arg1=0xffffffff81c57340 arg2="End scheduler-tick"
This looks good to me. Let me pick it.
Thanks!
>
> Fixes: f04dec93466a ("tracing/eprobes: Fix reading of string fields")
> Signed-off-by: Martin Kaiser <[email protected]>
> ---
> v2
> - use rcu event as an example, don't dereference a user pointer
> - add Fixes tag
>
> kernel/trace/trace_eprobe.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/trace/trace_eprobe.c b/kernel/trace/trace_eprobe.c
> index b66d6196338d..50518b071414 100644
> --- a/kernel/trace/trace_eprobe.c
> +++ b/kernel/trace/trace_eprobe.c
> @@ -315,7 +315,7 @@ get_event_field(struct fetch_insn *code, void *rec)
> val = (unsigned long)addr;
> break;
> case FILTER_PTR_STRING:
> - val = (unsigned long)(*(char *)addr);
> + val = *(unsigned long *)addr;
> break;
> default:
> WARN_ON_ONCE(1);
> --
> 2.43.7
>
--
Masami Hiramatsu (Google) <[email protected]>
