Re: [PATCH] tracing: guard trace_event_get_offsets() against an empty fields list

[Steven Rostedt]

On Fri, 16 Oct 2026 17:47:51 +0800
Haoran Wang <haoranwangsec@xxxxxxxxx> wrote:

> From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
> From: Haoran Wang <haoranwangsec@xxxxxxxxx>
> Date: Fri, 16 Oct 2026 16:30:00 +0800
> Subject: [PATCH] tracing: guard trace_event_get_offsets() against an empty fields list
> 
> trace_event_get_offsets() dereferences the first entry of the fields list
> returned by trace_get_fields() via list_first_entry().  list_first_entry()
> then returns the list head itself, and tail->offset + tail->size reads past
> it.  The corrupted result is used as the BPF context-size bound in
> __perf_event_set_bpf_prog():
> 
>     int off = trace_event_get_offsets(event->tp_event);
>     if (prog->aux->max_ctx_offset > off)
>             return -EACCES;
> 
> so a context-reading BPF program that ought to be rejected can instead be
> attached to a zero-field tracepoint (which still carries
> TRACE_EVENT_FL_TRACEPOINT) and read adjacent kernel memory when the
> tracepoint fires, bypassing the verifier's context-size confinement.
> 
> This is reachable through user_events: a user can register an event with no
> fields (e.g. `echo u:my_event > dynamic_events`), which leaves user->fields
> empty while the event remains a BPF-attachable tracepoint,
> trace_get_fields() then routes through user_event_get_fields() to that
> empty list. The corrupted
> result after list_first_entry is then used as the BPF context-size bound in
> __perf_event_set_bpf_prog(), which lets context-reading BPF programs attach
> to a zero-field tracepoint when they should be rejected with -EACCES.
> 

Hmm, so user events can have empty events. :-/

Beau, Is that a thing?

-- Steve


> Add list empty check to fix this bug.
> 
> Signed-off-by: Haoran Wang <haoranwangsec@xxxxxxxxx>
> ---
>  kernel/trace/trace_events.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
> --- a/kernel/trace/trace_events.c
> +++ b/kernel/trace/trace_events.c
> @@ -239,6 +239,10 @@ int trace_event_get_offsets(struct trace_event_call *call)
>  	struct list_head *head;
>  
>  	head = trace_get_fields(call);
> +
> +	if (list_empty(head))
> +		return sizeof(struct trace_entry);
> +
>  	/*
>  	 * head->next points to the last field with the largest offset,
>  	 * since it was added last by trace_define_field()