On Fri, 16 Oct 2026 17:47:51 +0800 Haoran Wang <[email protected]> wrote:
> From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 > From: Haoran Wang <[email protected]> > Date: Fri, 16 Oct 2026 16:30:00 +0800 > Subject: [PATCH] tracing: guard trace_event_get_offsets() against an empty > fields list > > trace_event_get_offsets() dereferences the first entry of the fields list > returned by trace_get_fields() via list_first_entry(). list_first_entry() > then returns the list head itself, and tail->offset + tail->size reads past > it. The corrupted result is used as the BPF context-size bound in > __perf_event_set_bpf_prog(): > > int off = trace_event_get_offsets(event->tp_event); > if (prog->aux->max_ctx_offset > off) > return -EACCES; > > so a context-reading BPF program that ought to be rejected can instead be > attached to a zero-field tracepoint (which still carries > TRACE_EVENT_FL_TRACEPOINT) and read adjacent kernel memory when the > tracepoint fires, bypassing the verifier's context-size confinement. > > This is reachable through user_events: a user can register an event with no > fields (e.g. `echo u:my_event > dynamic_events`), which leaves user->fields > empty while the event remains a BPF-attachable tracepoint, > trace_get_fields() then routes through user_event_get_fields() to that > empty list. The corrupted > result after list_first_entry is then used as the BPF context-size bound in > __perf_event_set_bpf_prog(), which lets context-reading BPF programs attach > to a zero-field tracepoint when they should be rejected with -EACCES. > Hmm, so user events can have empty events. :-/ Beau, Is that a thing? -- Steve > Add list empty check to fix this bug. > > Signed-off-by: Haoran Wang <[email protected]> > --- > kernel/trace/trace_events.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c > --- a/kernel/trace/trace_events.c > +++ b/kernel/trace/trace_events.c > @@ -239,6 +239,10 @@ int trace_event_get_offsets(struct trace_event_call > *call) > struct list_head *head; > > head = trace_get_fields(call); > + > + if (list_empty(head)) > + return sizeof(struct trace_entry); > + > /* > * head->next points to the last field with the largest offset, > * since it was added last by trace_define_field()
