On 03/18, Jiri Olsa wrote: > > +SYSCALL_DEFINE0(uretprobe) > +{ > + struct pt_regs *regs = task_pt_regs(current); > + unsigned long sregs[3], err; > + > + /* > + * We set rax and syscall itself changes rcx and r11, so the syscall > + * trampoline saves their original values on stack. We need to read > + * them and set original register values and fix the rsp pointer back. > + */ > + err = copy_from_user((void *) &sregs, (void *) regs->sp, sizeof(sregs)); ^^^^^^^^^^^^^^^^^ IIUC, it should be (void __user *)regs->sp to shut up the sparse checks. The 1st "(void *)" typecast is not needed. Correctness-wise looks good to me, FWIW Reviewed-by: Oleg Nesterov <oleg@xxxxxxxxxx>