Re: [PATCH] tracing: eprobe: read the complete FILTER_PTR_STRING pointer

[Steven Rostedt]

On Fri, 26 Jun 2026 12:20:36 +0200
Martin Kaiser <martin@xxxxxxxxx> wrote:

> > That is, to have +u0() say "this is going to be dereferencing user space".  
> 
> > I'll add Martin's patch and see if it makes the above work.  
> 
> I've just tried your command with my patch. It works for me, filenames are
> logged correctly.

Yep, this definitely looks like a fix. We have;

	addr = rec + field->offset;

Where addr points to the location of the field on the ring buffer, thus
your change to make it:

	val = *(unsigned long *)addr;

Reads the full "long size" of the event on the ring buffer, instead of
reading just one byte. It is "val" that gets dereferenced later by the
probe logic (the "+0u()"), which has all the protections we need.

I'll queue this up.

Thanks!

-- Steve