Re: [PATCH] tracing: guard trace_event_get_offsets() against an empty fields list

[Steven Rostedt]

On Fri, 16 Oct 2026 10:22:56 -0400
Steven Rostedt <rostedt@xxxxxxxxxxx> wrote:

> On Fri, 16 Oct 2026 17:47:51 +0800
> Haoran Wang <haoranwangsec@xxxxxxxxx> wrote:
> 
> > From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
> > From: Haoran Wang <haoranwangsec@xxxxxxxxx>
> > Date: Fri, 16 Oct 2026 16:30:00 +0800
> > Subject: [PATCH] tracing: guard trace_event_get_offsets() against an empty fields list
> > 
> > trace_event_get_offsets() dereferences the first entry of the fields list
> > returned by trace_get_fields() via list_first_entry().  list_first_entry()
> > then returns the list head itself, and tail->offset + tail->size reads past
> > it.  The corrupted result is used as the BPF context-size bound in
> > __perf_event_set_bpf_prog():
> > 
> >     int off = trace_event_get_offsets(event->tp_event);
> >     if (prog->aux->max_ctx_offset > off)
> >             return -EACCES;
> > 
> > so a context-reading BPF program that ought to be rejected can instead be
> > attached to a zero-field tracepoint (which still carries
> > TRACE_EVENT_FL_TRACEPOINT) and read adjacent kernel memory when the
> > tracepoint fires, bypassing the verifier's context-size confinement.
> > 
> > This is reachable through user_events: a user can register an event with no
> > fields (e.g. `echo u:my_event > dynamic_events`), which leaves user->fields
> > empty while the event remains a BPF-attachable tracepoint,
> > trace_get_fields() then routes through user_event_get_fields() to that
> > empty list. The corrupted
> > result after list_first_entry is then used as the BPF context-size bound in
> > __perf_event_set_bpf_prog(), which lets context-reading BPF programs attach
> > to a zero-field tracepoint when they should be rejected with -EACCES.
> >   
> 
> Hmm, so user events can have empty events. :-/

I meant "empty fields".

> 
> Beau, Is that a thing?

-- Steve