This is another run of the Coccinelle script for converting kmalloc()
family of allocations to kmalloc_obj() via the existing rules in
scripts/coccinelle/api/kmalloc_objs.cocci

This catches both the set of kmalloc() uses added since the first
kmalloc_obj() conversions in v7.0 and adds a large group missed in the
first pass due to Coccinelle not interacting well with the cleanup.h
scoped_...() family of macros[1]. I worked around this with spatch's
"--macro-file" argument to a file with all the scoped_...() macros mapped
to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control
flow indicator I could find.

Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc,
riscv, and s390 with no new warnings.

Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1]
Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2]
Signed-off-by: Kees Cook <kees+treewide@kernel.org>

Pull probes updates from Masami Hiramatsu:
 "BTF typecasting and variable fetch enhancements:

   - Typecast support across probe events: Extended BTF typecasting
     syntax (e.g., (STRUCT)PARAM->MEMBER) to kprobes, uprobes, and
     fprobes on function entry and return

   - Nested typecasts: Added support for chaining and nesting typecasts
     up to 3 levels, including casting registers and stack variables

   - Field specifier option: Added (STRUCT,FIELD) syntax to emulate
     container_of(), allowing retrieval of parent structures from member
     pointers

   - $current variable support: Introduced $current special variable to
     access the running task_struct via BTF dereferencing

   - Per-CPU variable access: Added this_cpu_read() and this_cpu_ptr()
     fetcharg methods to trace CPU-local data safely

   - Fetcharg bytecode dumper: Added CONFIG_PROBE_EVENTS_DUMP_FETCHARG
     to dump the compiled fetcharg bytecode instructions as comments in
     dynamic_events

   - Extended symbol name handling: Removed the MAX_COMMON_HEAD_LEN
     limit and extended MAX_ARGSTR_LEN to 256 bytes, enabling probing of
     long symbols, mangled Rust symbols and complex BTF expressions

   - eprobe variable syntax: Allowed eprobes to reference event fields
     directly without requiring a '$' prefix

   - Cleanup unused parameters, redundant codes, duplicate macros and
     pointer arithmetic

   - Use a ternary operator for simplifying fetch_type_from_btf_type()

  Expanded boot time dynamic probe support:

   - Add boot-time tracing configuration support for event probes
     (eprobes), function probes (fprobes), and tracepoint probes
     (tprobes)

   - Allow comment lines ('#') in dynamic_events file

  Optimization, robustness, and cleanups:

   - Simplify fprobe_remove_ips() by reusing graph and ftrace helpers

   - Remove __packed attribute from struct __fprobe_header to avoid
     unaligned memory access penalties on RISC architectures

   - Remove redundant memset() calls in perf event probe handlers

   - Replace legacy __ASSEMBLY__ with __ASSEMBLER__ in header files

  Selftests & refactoring:

   - Refactor parse_probe_arg() and parse_probe_vars(), and eliminate
     recursion in probe argument parsing to protect kernel stack depth

   - Add selftests for BTF typecasts and module probing without module
     prefixes

   - Force LC_ALL=C in ftracetest to prevent test failures on localized
     systems

   - Refactor btf_type_skip_modifiers() to remove ignored id parameter

   - Sort ERRORS list in trace_probe.h alphabetically

   - Fix typo in fprobe docs, and trace_fprobe function name

   - Rename FETCH_OP_DATA to FETCH_OP_IMMSTR

   - Make file offset error message probe-agnostic"

* tag 'probes-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (37 commits)
  fprobe: Simplify fprobe_remove_ips() by reusing existing helpers
  tracing/boot: Add support for eprobe, fprobe, and tprobe events
  selftests/ftrace: Force C locale in ftracetest
  tracing/probes: Treating longer symbol name on event comparation
  docs: trace: fprobe: fix 'thos' spelling
  tracing/probes: Fix extra whitespace in trace_probe_kernel.h
  tracing/kprobe: Remove redundant memset in kprobe_perf_func()
  tracing/fprobe: Remove redundant memset in fentry_perf_func()
  tracing/fprobe: Remove redundant snprintf in trace_fprobe_match_command_head()
  tracing/probes: Simplify BTF_KIND_PTR case in fetch_type_from_btf_type()
  tracing/probes: Cleanup pointer arithmetic in store_trace_entry_data()
  tracing/probes: Remove unused parameter from parse_probe_var_retval()
  tracing/probes: Remove redundant bounds check in trace_probe_compare_arg_type()
  tracing/probes: Remove redundant boolean conversion in trace_probe_has_single_file()
  tracing/probes: Remove duplicate MAX_ARRAY_LEN macro definition
  selftests/ftrace: Add test case for a symbol in a module without module name
  tracing/probes: Eliminate recursion in parse_probe_arg()
  tracing/probes: Extend max length of argument string
  tracing/probes: Sort ERRORS list in trace_probe.h alphabetically
  tracing/probes: Refactor parse_probe_arg()
  ...

fprobe_remove_ips() manually duplicates the unregister and filter-removal
logic for both graph and ftrace ops. Simplify it by delegating to the
existing fprobe_graph_remove_ips() and fprobe_ftrace_remove_ips() helpers.

Link: https://lore.kernel.org/all/178528139798.102586.5349128066643420018.stgit@devnote2/

Assisted-by: Antigravity:gemini-3.6-flash
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Reviewed-by: Steven Rostedt <rostedt@goodmis.org>

In register_fprobe(), get_ips_from_filter() resolves target function
addresses and increments module reference counts via try_module_get() for
symbols in kernel modules. If get_ips_from_filter() fails on the second
pass and returns an error, register_fprobe() returned directly without
releasing module references acquired up to that point.

Fix this by ensuring the cleanup loop executing module_put() runs even when
get_ips_from_filter() returns a negative error.

Link: https://lore.kernel.org/all/178528125360.101985.4144133640239273153.stgit@devnote2/

Fixes: d24fa977eec5 ("tracing: fprobe: Fix to lock module while registering fprobe")
Assisted-by: Antigravity:gemini-3.6-flash
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

fp pointer and unsigned long have the same size on all relevant
architectures that build Linux. Furthermore this struct is only used in
architectures that do not set ARCH_DEFINE_ENCODE_FPROBE_HEADER which is
set only for 64bit architectures (apart from LoongArch).

Both fields are aligned on these architectures so the struct with
__packed and without it are the same.

Remove the __packed as it is unnecessary.

[Masami: Removed Fixes tag because this is not fixing any problem.]

Link: https://lore.kernel.org/all/20260428-topic-fprobe-packed-v7-1-v1-1-9abc9b866b4c@baylibre.com/

Signed-off-by: Markus Schneider-Pargmann (The Capable Hub) <msp@baylibre.com>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

fprobe_fgraph_entry() sizes a shadow-stack reservation in one walk of
the per-ip fprobe list and fills it in a second walk, both under
rcu_read_lock() only. A fprobe registered on an already-live ip can
become visible between the two walks, so the fill walk processes an
exit_handler the sizing walk did not count and used runs past
reserved_words. If the sizing walk counted nothing, fgraph_data is NULL
and the first write_fprobe_header() faults:

  Oops: general protection fault, probably for non-canonical address ...
  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
  RIP: 0010:fprobe_fgraph_entry+0xa38/0xf10 kernel/trace/fprobe.c:167
  Call Trace:
   <TASK>
   function_graph_enter_regs+0x44c/0xa10 kernel/trace/fgraph.c:677
   ftrace_graph_func+0xc5/0x140 arch/x86/kernel/ftrace.c:671
   __kernel_text_address+0x9/0x40 kernel/extable.c:78
   arch_stack_walk+0x117/0x170 arch/x86/kernel/stacktrace.c:26
   kmem_cache_free+0x188/0x580 mm/slub.c:6378
   tcp_data_queue+0x18d/0x6550 net/ipv4/tcp_input.c:5590
   [...]
   </TASK>

The list cannot be frozen across the two walks, so skip a node that does
not fit the reservation and count it as missed.

Link: https://lore.kernel.org/all/20260619184425.3824774-1-rhkrqnwk98@gmail.com/

Fixes: 4346ba160409 ("fprobe: Rewrite fprobe on function-graph tracer")
Signed-off-by: Sechang Lim <rhkrqnwk98@gmail.com>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

Commit 4346ba1604093 ("fprobe: Rewrite fprobe on function-graph tracer")
changed fprobe to register struct fprobe to an rcu-hlist, but it forgot
to wait for RCU GP. Thus there can be use-after-free if the fprobe is
released right after unregistering. This can be happened on fprobe
event and sample module code.

To fix this issue, add synchronize_rcu() in unregister_fprobe().

Note that BPF is OK because fprobe is used as a part of
bpf_kprobe_multi_link. This unregisters its fprobe in
bpf_kprobe_multi_link_release() and it is deallocated via
bpf_kprobe_multi_link_dealloc(), which is invoked from
bpf_link_defer_dealloc_rcu_gp() RCU callback.

For BPF, this also introduced unregister_fprobe_async() which does
NOT wait for RCU grace priod.

Link: https://lore.kernel.org/all/177813998919.256460.2809243930741138224.stgit@mhiramat.tok.corp.google.com/

Fixes: 4346ba1604093 ("fprobe: Rewrite fprobe on function-graph tracer")
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

Fix fprobe to unregister ftrace_ops if corresponding type of fprobe
does not exist on the fprobe_ip_table and it is expected to be empty
when unloading modules.

Since ftrace thinks that the empty hash means everything to be traced,
if we set fprobes only on the unloaded module, all functions are traced
unexpectedly after unloading module.
e.g.

 # modprobe xt_LOG.ko
 # echo 'f:test log_tg*' > dynamic_events
 # echo 1 > events/fprobes/test/enable
 # cat enabled_functions
log_tg [xt_LOG] (1)             tramp: 0xffffffffa0004000 (fprobe_ftrace_entry+0x0/0x490) ->fprobe_ftrace_entry+0x0/0x490
log_tg_check [xt_LOG] (1)               tramp: 0xffffffffa0004000 (fprobe_ftrace_entry+0x0/0x490) ->fprobe_ftrace_entry+0x0/0x490
log_tg_destroy [xt_LOG] (1)             tramp: 0xffffffffa0004000 (fprobe_ftrace_entry+0x0/0x490) ->fprobe_ftrace_entry+0x0/0x490
 # rmmod xt_LOG
 # wc -l enabled_functions
34085 enabled_functions

Link: https://lore.kernel.org/all/177669368776.132053.10042301916765771279.stgit@mhiramat.tok.corp.google.com/

Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

Commit 2c67dc457bc6 ("tracing: fprobe: optimization for entry only case")
introduced a different ftrace_ops for entry-only fprobes.

However, when unregistering an fprobe, the kernel only checks if another
fprobe exists at the same address, without checking which type of fprobe
it is.
If different fprobes are registered at the same address, the same address
will be registered in both fgraph_ops and ftrace_ops, but only one of
them will be deleted when unregistering. (the one removed first will not
be deleted from the ops).

This results in junk entries remaining in either fgraph_ops or ftrace_ops.
For example:
 =======
 cd /sys/kernel/tracing

 # 'Add entry and exit events on the same place'
 echo 'f:event1 vfs_read' >> dynamic_events
 echo 'f:event2 vfs_read%return' >> dynamic_events

 # 'Enable both of them'
 echo 1 > events/fprobes/enable
 cat enabled_functions
vfs_read (2)            ->arch_ftrace_ops_list_func+0x0/0x210

 # 'Disable and remove exit event'
 echo 0 > events/fprobes/event2/enable
 echo -:event2 >> dynamic_events

 # 'Disable and remove all events'
 echo 0 > events/fprobes/enable
 echo > dynamic_events

 # 'Add another event'
 echo 'f:event3 vfs_open%return' > dynamic_events
 cat dynamic_events
f:fprobes/event3 vfs_open%return

 echo 1 > events/fprobes/enable
 cat enabled_functions
vfs_open (1)            tramp: 0xffffffffa0001000 (ftrace_graph_func+0x0/0x60) ->ftrace_graph_func+0x0/0x60    subops: {ent:fprobe_fgraph_entry+0x0/0x620 ret:fprobe_return+0x0/0x150}
vfs_read (1)            tramp: 0xffffffffa0001000 (ftrace_graph_func+0x0/0x60) ->ftrace_graph_func+0x0/0x60    subops: {ent:fprobe_fgraph_entry+0x0/0x620 ret:fprobe_return+0x0/0x150}
 =======

As you can see, an entry for the vfs_read remains.

To fix this issue, when unregistering, the kernel should also check if
there is the same type of fprobes still exist at the same address, and
if not, delete its entry from either fgraph_ops or ftrace_ops.

Link: https://lore.kernel.org/all/177669367993.132053.10553046138528674802.stgit@mhiramat.tok.corp.google.com/

Fixes: 2c67dc457bc6 ("tracing: fprobe: optimization for entry only case")
Cc: stable@vger.kernel.org
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

fprobe_remove_node_in_module() is called under RCU read locked, but
this invokes kcalloc() if there are more than 8 fprobes installed
on the module. Sashiko warns it because kcalloc() can sleep [1].

 [1] https://sashiko.dev/#/patchset/177552432201.853249.5125045538812833325.stgit%40mhiramat.tok.corp.google.com

To fix this issue, expand the batch size to 128 and do not expand
the fprobe_addr_list, but just cancel walking on fprobe_ip_table,
update fgraph/ftrace_ops and retry the loop again.

Link: https://lore.kernel.org/all/177669367206.132053.1493637946869032744.stgit@mhiramat.tok.corp.google.com/

Fixes: 0de4c70d04a4 ("tracing: fprobe: use rhltable for fprobe_ip_table")
Cc: stable@vger.kernel.org
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>