Pull probes fixes from Masami Hiramatsu:
 "fprobe fixes and spelling typos:

   - Fix NULL pointer dereference in fprobe_fgraph_entry(). Prevent
     general protection faults by checking shadow-stack reservation
     bounds. Skip mid-flight registered fprobes that were not counted
     during sizing.

  eprobe: fix string pointer extraction

   - Correct the casting of string pointers read from the ringbuffer to
     prevent truncation of base event pointer variables when
     dereferencing FILTER_PTR_STRING fields.

  tracing/probes: clean up argument parsing and BTF helper logic

   - Make the $ prefix mandatory for comm access: Require the $ prefix
     for special fetcharg variables like $comm and $COMM, preventing
     naming conflicts with regular BTF-based event fields.

   - Fix double addition of offset for @+FOFFSET: Clear the temporary
     offset variable after setting the FETCH_OP_FOFFS instruction to
     avoid applying the offset multiple times.

   - Remove WARN_ON_ONCE from parse_btf_arg: Prevent triggering a kernel
     warning via user-space input when creating a kprobe event on a raw
     address.

   - Fix typo in a log message: Correct a spelling error ("$-valiable")
     in trace probe log messages.

  samples/trace_events: improve error checking

   - Validate the thread pointer returned from kthread_run() in the
     trace events sample code to properly handle thread creation
     failures"

* tag 'probes-fixes-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  tracing/probes: Make the $ prefix mandatory for comm access
  tracing/fprobe: Fix NULL pointer dereference in fprobe_fgraph_entry()
  tracing/probes: Fix double addition of offset for @+FOFFSET
  tracing: eprobe: read the complete FILTER_PTR_STRING pointer
  tracing/events: Fix to check the simple_tsk_fn creation
  tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg
  tracing: probes: fix typo in a log message

Since $comm or $COMM are not event field but special fetcharg
variables to access current->comm, It should not be accessed
without '$' prefix even with typecast.

Link: https://lore.kernel.org/all/178231209724.732967.12049805699091810641.stgit@devnote2/

Fixes: 69efd863a785 ("tracing/eprobes: Allow use of BTF names to dereference pointers")
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

fprobe_fgraph_entry() sizes a shadow-stack reservation in one walk of
the per-ip fprobe list and fills it in a second walk, both under
rcu_read_lock() only. A fprobe registered on an already-live ip can
become visible between the two walks, so the fill walk processes an
exit_handler the sizing walk did not count and used runs past
reserved_words. If the sizing walk counted nothing, fgraph_data is NULL
and the first write_fprobe_header() faults:

  Oops: general protection fault, probably for non-canonical address ...
  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
  RIP: 0010:fprobe_fgraph_entry+0xa38/0xf10 kernel/trace/fprobe.c:167
  Call Trace:
   <TASK>
   function_graph_enter_regs+0x44c/0xa10 kernel/trace/fgraph.c:677
   ftrace_graph_func+0xc5/0x140 arch/x86/kernel/ftrace.c:671
   __kernel_text_address+0x9/0x40 kernel/extable.c:78
   arch_stack_walk+0x117/0x170 arch/x86/kernel/stacktrace.c:26
   kmem_cache_free+0x188/0x580 mm/slub.c:6378
   tcp_data_queue+0x18d/0x6550 net/ipv4/tcp_input.c:5590
   [...]
   </TASK>

The list cannot be frozen across the two walks, so skip a node that does
not fit the reservation and count it as missed.

Link: https://lore.kernel.org/all/20260619184425.3824774-1-rhkrqnwk98@gmail.com/

Fixes: 4346ba160409 ("fprobe: Rewrite fprobe on function-graph tracer")
Signed-off-by: Sechang Lim <rhkrqnwk98@gmail.com>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

Since commit 533059281ee5 ("tracing: probeevent: Introduce new argument
 fetching code") wrongly use @offset local variable during the parsing,
the offset value is added twice when dereferencing.
Reset the @offset after setting it in FETCH_OP_FOFFS.

Link: https://lore.kernel.org/all/178217905962.643090.1978577464942171332.stgit@devnote2/

Fixes: 533059281ee5 ("tracing: probeevent: Introduce new argument fetching code")
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Cc: stable@vger.kernel.org

For a char * element in an event, the FILTER_PTR_STRING filter type is
used. When the event occurs, a pointer is stored in the ringbuffer.

If an eprobe references such a char * element of a "base event", the
stored pointer is truncated when it's read from the ringbuffer.

$ cd /sys/kernel/tracing
$ echo 'e rcu.rcu_utilization $s:x64 $s:string' > dynamic_events
$ echo 1 > tracing_on
$ echo 1 > events/eprobes/enable
$ sleep 1
$ echo 0 > events/eprobes/enable
$ cat trace
   <idle>-0  ...: (rcu.rcu_utilization) arg1=0x4f arg2=(fault)
   <idle>-0  ...: (rcu.rcu_utilization) arg1=0x2 arg2=(fault)

The problem is in get_event_field

	val = (unsigned long)(*(char *)addr);

addr points to the position in the ringbuffer where the pointer was
stored. The assignment reads only the lowest byte of the pointer.

Fix the cast to read the whole pointer. The output of the test above
is now

<idle>-0 ... arg1=0xffffffff81c7d3f3 arg2="Start scheduler-tick"
<idle>-0 ... arg1=0xffffffff81c57340 arg2="End scheduler-tick"

Link: https://lore.kernel.org/all/20260620145339.3234726-1-martin@kaiser.cx/

Fixes: f04dec93466a ("tracing/eprobes: Fix reading of string fields")
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

Sashiko found that user can cause this WARN_ON_ONCE() easily
with adding a kprobe event based on a raw address with BTF
parameter.

Since this is not an unexpected condition, remove the
WARN_ON_ONCE().

Link: https://lore.kernel.org/all/178177265367.2059927.13789953014706792126.stgit@mhiramat.tok.corp.google.com/

Link: https://sashiko.dev/#/patchset/178165816303.269421.7302603996990753309.stgit%40devnote2

Reported-by: Sashiko <sashiko-bot@kernel.org>
Fixes: b576e09701c7 ("tracing/probes: Support function parameters if BTF is available")
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

Fix a typo ("Invalid $-variable") in a log message.

Link: https://lore.kernel.org/all/20260507081041.885781-4-martin@kaiser.cx/

Fixes: ab105a4fb894 ("tracing: Use tracing error_log with probe events")
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

As reported by sashiko we use __get_user without prior access_ok call on the
user space pointer. Adding the missing call for the whole pointer array.

Plus removing the err check in the error path, because it's not needed and
also we can return -ENOMEM directly from the first kvmalloc_array fail path.

Cc: stable@vger.kernel.org
[1] https://lore.kernel.org/bpf/20260611115503.AC16D1F00893@smtp.kernel.org/
Fixes: 0236fec57a15 ("bpf: Resolve symbols with ftrace_lookup_symbols for kprobe multi link")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/bpf/20260611115503.AC16D1F00893@smtp.kernel.org/
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Link: https://lore.kernel.org/r/20260616083056.405652-1-jolsa@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

Pull ring-buffer updates from Steven Rostedt

 - Do not invalidate entire buffer for invalid sub-buffers

   For the persistent ring buffer, if one sub-buffer is found to be
   invalid, it invalidates the entire per CPU ring buffer. This can lose
   a lot of valuable data if there's some corruption with the writes to
   the buffer not syncing properly on a hard crash. Instead, if a
   sub-buffer is found to be invalid, simply zero it out and mark it for
   "missed events".

   When the persistent ring buffer is read and a sub-buffer that was
   cleared due to being invalid on boot up is discovered, the output
   will show "[LOST EVENTS]" to let the user know that events were
   missing at that location. Displaying the events from valid buffers
   can still be useful.

 - Add a test to be able to test corrupted sub-buffers

   If a persistent ring buffer is created as "ptraingtest" and the new
   config that adds the test is enabled, when a panic happens, the
   kernel will randomly corrupt one of the per CPU ring buffers. On boot
   up, the sub-buffers with the corruption should be cleared and
   flagged. When reading this buffer, the missed events should should
   [LOST EVENTS].

 - Add commit number in the sub-buffer meta debug info

   The commit is used to know the content of a meta page. Add it to the
   buffer_meta file that is shown for each per CPU buffer.

 - Clean up the persistent ring buffer validation code

   Add some helper functions and make variable names more consistent.

* tag 'trace-ring-buffer-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  ring-buffer: Better comment the use of RB_MISSED_EVENTS
  ring-buffer: Show persistent buffer dropped events in trace_pipe file
  ring-buffer: Show persistent buffer dropped events in trace file
  ring-buffer: Have dropped subbuffers be persistent across reboots
  ring-buffer: Cleanup buffer_data_page related code
  ring-buffer: Cleanup persistent ring buffer validation
  ring-buffer: Show commit numbers in buffer_meta file
  ring-buffer: Add persistent ring buffer invalid-page inject test
  ring-buffer: Skip invalid sub-buffers when rewinding persistent ring buffer
  ring-buffer: Skip invalid sub-buffers when validating persistent ring buffer

Pull tracing updates from Steven Rostedt:

 - Remove a redundant IS_ERR() check

   trace_pipe_open() already checks for IS_ERR() and does it again in
   the return path. Remove the return check.

 - Export seq_buf_putmem_hex() to allow kunit tests against them

   To add Kunit tests on seq_buf_putmem_hex(), it needs to be exported.

 - Replace strcat() and strcpy() with seq_buf() logic

   The code for synthetic events uses a series of strcat() and strcpy()
   which can be error prone. Replace them with seq_buf() logic that does
   all the necessary bound checking.

 - Add a lockdep rcu_is_watching() to trace_##event##_enabled() call

   The trace_##event##_enabled() is a static branch that is true if the
   "event" is enabled. But this can hide bugs if this logic is in a
   location where RCU is disabled and not "watching". It would only
   trigger if lockdep is enabled and the event is enabled.

   Add a "rcu_is_watching()" warning if lockdep is enabled in that
   helper function to trigger regardless if the event is enabled or not.

 - Remove the local variable in the trace_printk() macro

   For name space integrity, remove the _______STR variable in the
   trace_printk() macro for using the sizeof() macro directly.

 - Use guard()s for the trace_recursion_record.c file

 - Fix typo in a comment of eventfs_callback() kerneldoc

 - Use trace_call__##event() in events within trace_##event##_enabled()

   A couple of events are called within an if block guarded by
   trace_##event##_enabled(). That is a static key that is only enabled
   when the event is enabled. The trace_call_##event() calls the
   tracepoint code directly without adding a redundant static key for
   that check.

 - Allow perf to read synthetic events

   Currently, perf does not have the ability to enable a synthetic
   event. If it does, it will either cause a kernel warning or error
   with "No such device". Synthetic events are not much different than
   kprobes and perf can handle fine with a few modifications.

 - Replace printk(KERN_WARNING ...) with pr_warn()

 - Replace krealloc() on an array with krealloc_array()

 - Fix README file path name for synthetic events

 - Change tracing_map tracing_map_array to use a flexible array

   Instead of allocating a separate pointer to hold the pages field of
   tracing_map_array, allocate the pages field as a flexible array when
   allocating the structure.

 - Fold trace_iterator_increment() into trace_find_next_entry_inc()

   The function trace_iterator_increment() was only used by
   trace_find_next_entry_inc(). It's not big enough to be a helper
   function for one user. Fold it into its caller.

 - Make field_var_str field a flexible array of hist_elt_data

   Instead of allocating a separate pointer for the field_var_str array
   of the hist_elt_data structure, allocate it as a flexible array when
   allocating the structure.

 - Disable KCOV for trace_irqsoff.c

   Like trace_preemptirq.c, trace_irqsoff.c has code that will crash
   when KCOV is enabled on ARM. The irqsoff tracing can be called on ARM
   because the irqsoff tracing code can be run from early interrupt code
   and produce coverage unrelated to syscall inputs.

 - Fix warning in __unregister_ftrace_function() called by perf

   Perf calls unregister_ftrace_function() without checking if its
   ftrace_ops has already been unregistered. There's an error path where
   on clean up it will unregister the ftrace_ops even if it wasn't
   registered and causes a warning.

* tag 'trace-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  perf/ftrace: Fix WARNING in __unregister_ftrace_function
  tracing: Disable KCOV instrumentation for trace_irqsoff.o
  tracing: Turn hist_elt_data field_var_str into a flexible array
  tracing: Move trace_iterator_increment() into trace_find_next_entry_inc()
  tracing: Simplify pages allocation for tracing_map logic
  tracing: Fix README path for synthetic_events
  tracing: Use krealloc_array() for trace option array growth
  tracing/branch: Use pr_warn() instead of printk(KERN_WARNING)
  tracing: Allow perf to read synthetic events
  HID: Use trace_call__##name() at guarded tracepoint call sites
  cpufreq: amd-pstate: Use trace_call__##name() at guarded tracepoint call site
  tracefs: Fix typo in a comment of eventfs_callback() kerneldoc
  tracing: Switch trace_recursion_record.c code over to use guard()
  tracing: Remove local variable for argument detection from trace_printk()
  tracepoint: Add lockdep rcu_is_watching() check to trace_##name##_enabled()
  tracing: Bound synthetic-field strings with seq_buf
  seq_buf: Export seq_buf_putmem_hex() and add KUnit tests
  tracing: Remove redundant IS_ERR() check in trace_pipe_open()