[PATCH 00/12] tracing/probes: Fix various bugs in dynamic probe events

[Masami Hiramatsu (Google)]

Hi,

This series fixes several bugs in dynamic probe events (kprobe, fprobe,
uprobe, and eprobe) and BTF/fetch-argument handling:

- [01/12] Check whether the target event is enabled or busy before
  unlinking a sibling probe during multiprobe unregistration, and add
  the missing checks to trace_uprobe and trace_eprobe.
- [02/12] Enable newly appended fprobes and uprobes immediately when
  the target multiprobe event is already enabled, matching trace_kprobe
  behavior.
- [03/12] Fix BTF bitfield parsing for non-kflag bitfields (such as
  enum bitfields), select a narrow container fetch type to avoid
  out-of-bounds buffer writes, and compute bitfield extraction
  parameters from the container width with bounds validation.
- [04/12] Add missing BTF_KIND_PTR, NULL, and BTF_KIND_INT checks in
  btf_type_is_char_ptr() and btf_type_is_char_array().
- [05/12] Use explicit fixed-width integer types (s8/u8, s16/u16,
  s32/u32) in eprobe get_event_field() so 1-byte signed fields are
  properly sign-extended under -funsigned-char.
- [06/12] Disallow attaching eprobes to fprobe events to prevent
  potential recursion issues, matching kprobes and uprobes.
- [07/12] Check FETCH_OP_UDEREF before advancing the fetch instruction
  pointer in finalize_fetch_insn() so user-space dereference string
  arrays emit FETCH_OP_ST_USTRING instead of FETCH_OP_ST_STRING.

Minor updates/cleanups:
- [08/12] Reject array specifiers on non-dereference string sources
  (such as $comm or symstr) in finalize_fetch_insn().
- [09/12] Allow the symstr type on function entry arguments ($argN) in
  return probes (FETCH_OP_EDATA).
- [10/12] Reject empty fetch expressions before :%pd and :%pD in
  traceprobe_expand_dentry_args().
- [11/12] Validate the command prefix in kprobe, uprobe, and eprobe
  creation when the colon separator is omitted so invalid prefixes are
  rejected.
- [12/12] Propagate actual error return codes in eprobe and fprobe
  creation paths instead of overwriting them with -EINVAL.

Notes:
- These bugs were identified and the fixes and cover letter were
  prepared with the assistance of an LLM coding assistant.

Thank you,

---
base-commit: be94710b1f6ba1bea33e73129c110af80e999b2d

Masami Hiramatsu (Google) (12):
      tracing/probes: Check enabled and busy state before unlinking sibling probes
      tracing/probes: Enable newly appended probe when target event is enabled
      tracing/probes: Fix BTF bitfield parsing and out-of-bounds buffer write
      tracing/probes: Fix missing BTF kind checks in char pointer/array helpers
      tracing/eprobe: Fix 1-byte signed field fetch in get_event_field()
      tracing/eprobe: Disallow attaching eprobes to fprobe events
      tracing/probes: Fix user-space dereference string array store type
      tracing/probes: Reject array count on non-dereference string sources
      tracing/probes: Allow symstr type for function entry arguments in return probes
      tracing/probes: Reject empty fetch expression for %pd and %pD
      tracing/probes: Validate command prefix in kprobe, uprobe, and eprobe
      tracing/probes: Propagate error codes in eprobe and fprobe creation


 kernel/trace/trace_eprobe.c |   39 ++++++++++++-------
 kernel/trace/trace_fprobe.c |   26 ++++++-------
 kernel/trace/trace_kprobe.c |   11 +++--
 kernel/trace/trace_probe.c  |   88 ++++++++++++++++++++++++++++++++++---------
 kernel/trace/trace_uprobe.c |   76 +++++++++++++++++++++++++------------
 5 files changed, 165 insertions(+), 75 deletions(-)

-- 
Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>