From c0c7c3f9d2e7d9ecc44e536d6f39f44b1faf6044 Mon Sep 17 00:00:00 2001 From: Haoran Wang Date: Fri, 16 Oct 2026 16:30:00 +0800 Subject: [PATCH] tracing: Guard trace_event_get_offsets() against an empty fields list trace_event_get_offsets() dereferences the first entry of the fields list returned by trace_get_fields() via list_first_entry(). list_first_entry() then returns the list head itself, and tail->offset + tail->size reads past it. The corrupted result is used as the BPF context-size bound in __perf_event_set_bpf_prog(): int off = trace_event_get_offsets(event->tp_event); if (prog->aux->max_ctx_offset > off) return -EACCES; so a context-reading BPF program that ought to be rejected can instead be attached to a zero-field tracepoint (which still carries TRACE_EVENT_FL_TRACEPOINT) and read adjacent kernel memory when the tracepoint fires, bypassing the verifier's context-size confinement. This is reachable through user_events: a user can register an event with no fields (e.g. `echo u:my_event > dynamic_events`), which leaves user->fields empty while the event remains a BPF-attachable tracepoint, trace_get_fields() then routes through user_event_get_fields() to that empty list. The corrupted result after list_first_entry is then used as the BPF context-size bound in __perf_event_set_bpf_prog(), which lets context-reading BPF programs attach to a zero-field tracepoint when they should be rejected with -EACCES. Add list empty check to fix this bug. Link: https://patch.msgid.link/6ad1f2ca.6048f038.32d739.a530@mx.google.com Signed-off-by: Haoran Wang Signed-off-by: Steven Rostedt --- kernel/trace/trace_events.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index a1ac2a02f4e2..6afed2091e19 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -246,6 +246,10 @@ int trace_event_get_offsets(struct trace_event_call *call) struct list_head *head; head = trace_get_fields(call); + + if (list_empty(head)) + return sizeof(struct trace_entry); + /* * head->next points to the last field with the largest offset, * since it was added last by trace_define_field()