[PATCH 05/12] tracing/eprobe: Fix 1-byte signed field fetch in get_event_field()

From: Masami Hiramatsu (Google)

Date: Sun Nov 08 2026 - 19:32:24 EST


From: Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>

Because the kernel is built with -funsigned-char, plain 'char' is
unsigned on all architectures. Reading 1-byte signed trace event fields
via *(char *)addr in get_event_field() therefore zero-extends instead of
sign-extending negative s8 values.

Use explicit fixed-width integer types (s8/u8, s16/u16, s32/u32) when
reading event fields.

Fixes: 7491e2c44278 ("tracing: Add a probe that attaches to trace events")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>
---
kernel/trace/trace_eprobe.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/kernel/trace/trace_eprobe.c b/kernel/trace/trace_eprobe.c
index f1590c9af6b2..9defe86f4e8f 100644
--- a/kernel/trace/trace_eprobe.c
+++ b/kernel/trace/trace_eprobe.c
@@ -334,21 +334,21 @@ get_event_field(struct fetch_insn *code, void *rec)
switch (field->size) {
case 1:
if (field->is_signed)
- val = *(char *)addr;
+ val = *(s8 *)addr;
else
- val = *(unsigned char *)addr;
+ val = *(u8 *)addr;
break;
case 2:
if (field->is_signed)
- val = *(short *)addr;
+ val = *(s16 *)addr;
else
- val = *(unsigned short *)addr;
+ val = *(u16 *)addr;
break;
case 4:
if (field->is_signed)
- val = *(int *)addr;
+ val = *(s32 *)addr;
else
- val = *(unsigned int *)addr;
+ val = *(u32 *)addr;
break;
default:
if (field->size == sizeof(long)) {