On Thu, 15 Oct 2026 16:51:58 +0800 Haoran Wang <[email protected]> wrote:
> 6. Proof of Concept > > The reproduction runs on 7.2.10 kernel. A custom-tracepoint module > (zerofield_mod) registers a zero-field tracepoint (empty TP_STRUCT__entry) The real fix is to reject any event with an empty TP_STRUCT__entry. -- Steve > and places an inert 64-byte 0x53 sentinel in .ref.data right after the > 72-byte event_class global (GCC lays out same-section statics by > descending size), so the kernel's OOB read of class+84/class+88 picks up > 0x53535353 instead of zero section padding. The sentinel is inert data -- > it does not change kernel control flow or inject a bug; it only makes the > pre-existing OOB read's effect observable (off becomes non-zero instead of > silently zero, the latter being indistinguishable from a fixed kernel > returning 0).
