[for-next][PATCH 2/3] tracing: Guard trace_event_get_offsets() against an empty fields list

[Steven Rostedt]

From: Haoran Wang <haoranwangsec@xxxxxxxxx>

trace_event_get_offsets() dereferences the first entry of the fields list
returned by trace_get_fields() via list_first_entry().  list_first_entry()
then returns the list head itself, and tail->offset + tail->size reads past
it.  The corrupted result is used as the BPF context-size bound in
__perf_event_set_bpf_prog():

    int off = trace_event_get_offsets(event->tp_event);
    if (prog->aux->max_ctx_offset > off)
            return -EACCES;

so a context-reading BPF program that ought to be rejected can instead be
attached to a zero-field tracepoint (which still carries
TRACE_EVENT_FL_TRACEPOINT) and read adjacent kernel memory when the
tracepoint fires, bypassing the verifier's context-size confinement.

This is reachable through user_events: a user can register an event with no
fields (e.g. `echo u:my_event > dynamic_events`), which leaves user->fields
empty while the event remains a BPF-attachable tracepoint,
trace_get_fields() then routes through user_event_get_fields() to that
empty list. The corrupted
result after list_first_entry is then used as the BPF context-size bound in
__perf_event_set_bpf_prog(), which lets context-reading BPF programs attach
to a zero-field tracepoint when they should be rejected with -EACCES.

Add list empty check to fix this bug.

Link: https://patch.msgid.link/6ad1f2ca.6048f038.32d739.a530@xxxxxxxxxxxxx
Signed-off-by: Haoran Wang <haoranwangsec@xxxxxxxxx>
Signed-off-by: Steven Rostedt <rostedt@xxxxxxxxxxx>
---
 kernel/trace/trace_events.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index a1ac2a02f4e2..6afed2091e19 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -246,6 +246,10 @@ int trace_event_get_offsets(struct trace_event_call *call)
 	struct list_head *head;
 
 	head = trace_get_fields(call);
+
+	if (list_empty(head))
+		return sizeof(struct trace_entry);
+
 	/*
 	 * head->next points to the last field with the largest offset,
 	 * since it was added last by trace_define_field()
-- 
2.53.0