After seeing something similar with the following command on 3.14.0-0.rc4.git3.1.fc21.x86_64:

====
# stap -L 'kernel.function("__handle_mm_fault").*'
kernel.function("__handle_mm_fault@mm/memory.c:3696").inline $flags:unsigned int $address:long unsigned int $vma:struct vm_area_struct* $mm:struct mm_struct*
kernel.function("do_huge_pmd_anonymous_page@mm/huge_memory.c:786") $mm:struct mm_struct* $vma:struct vm_area_struct* $address:long unsigned int $pmd:pmd_t* $flags:unsigned int
kernel.function("do_huge_pmd_numa_page@mm/huge_memory.c:1295") $mm:struct mm_struct* $vma:struct vm_area_struct* $addr:long unsigned int $pmd:pmd_t $pmdp:pmd_t*
kernel.function("do_huge_pmd_wp_page@mm/huge_memory.c:1122") $mm:struct mm_struct* $vma:struct vm_area_struct* $address:long unsigned int $pmd:pmd_t* $orig_pmd:pmd_t
kernel.function("huge_pmd_set_accessed@mm/huge_memory.c:921") $mm:struct mm_struct* $vma:struct vm_area_struct* $address:long unsigned int $pmd:pmd_t* $orig_pmd:pmd_t $dirty:int
kernel.function("hugetlb_fault@mm/hugetlb.c:2899") $mm:struct mm_struct* $vma:struct vm_area_struct* $address:long unsigned int $flags:unsigned int $hugetlb_instantiation_mutex:struct mutex
kernel.function("is_vma_temporary_stack@mm/rmap.c:1435") $vma:struct vm_area_struct*
kernel.function("pmd_numa@include/asm-generic/pgtable.h:665") $pmd:pmd_t
kernel.function("pmd_trans_huge@/usr/src/debug/kernel-3.13.fc21/linux-3.14.0-0.rc4.git3.1.fc21.x86_64/arch/x86/include/asm/pgtable.h:164") $pmd:pmd_t
kernel.function("pmd_trans_splitting@/usr/src/debug/kernel-3.13.fc21/linux-3.14.0-0.rc4.git3.1.fc21.x86_64/arch/x86/include/asm/pgtable.h:159") $pmd:pmd_t
====

So, I did a git bisect. It looks like this started with the following commit:

====
commit 67959c62576af851d8ae220d836ca6b527ec6aea
Author: Jonathan Lebon <jlebon@redhat.com>
Date:   Tue Jan 28 14:51:07 2014 -0500

    implement iterate_over_callees()
    
    In this patch, we actually implement iterate_over_callees(). This
    function looks for inlined subroutines or GNU_call_sites and calls the
    callback for each found. The query_callee() callback for now simply does
    a query_statement on the callee found. Logic is added in the next patch
    to limit probing to calls from caller only.
====

(In reply to David Smith from comment #0)
> On rawhide (3.14.0-0.rc2.git4.1.fc21.x86_64), I'm seeing the following with
> systemtap HEAD:
> 
> ====
> # stap -L 'kernel.function("sock_release").*'
> kernel.function("debug_lockdep_rcu_enabled@kernel/rcu/update.c:136")
> kernel.function("iput@fs/inode.c:1431") $inode:struct inode*
> kernel.function("module_put@kernel/module.c:968") $module:struct module*
> kernel.function("printk@kernel/printk/printk.c:1675") $fmt:char const*
> $args:va_list
> kernel.function("sock_release@net/socket.c:585").call $sock:struct socket*
> kernel.function("sock_release@net/socket.c:585").exported $sock:struct
> socket*
> kernel.function("sock_release@net/socket.c:585").return $sock:struct socket*
> ====
> 
> I would have expected it to only return the last 3.

The issue was that .* was getting expanded to .callees, which then expanded to all callee functions. This is now fixed in commit e772a6e by making more clear the derivation steps:

$ stap -L 'kernel.function("sock_release").*'
kernel.function("sock_release@net/socket.c:585").call $sock:struct socket*
kernel.function("sock_release@net/socket.c:585").callee("iput@fs/inode.c:1431") $inode:struct inode*
kernel.function("sock_release@net/socket.c:585").callee("module_put@kernel/module.c:970") $module:struct module*
kernel.function("sock_release@net/socket.c:585").callee("printk@kernel/printk/printk.c:1676") $fmt:char const* $args:va_list
kernel.function("sock_release@net/socket.c:585").exported $sock:struct socket*
kernel.function("sock_release@net/socket.c:585").return $sock:struct socket*
$