From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Haoran Wang <[email protected]> Date: Fri, 16 Oct 2026 15:10:00 +0800 Subject: [PATCH] tracing: reject trace events with an empty TP_STRUCT__entry
trace_event_get_offsets() unconditionally dereferences the first entry of an event class's fields list through list_first_entry(). A tracepoint that declares an empty TP_STRUCT__entry never populates that list. Its fields_array holds only the terminating sentinel, so list_first_entry() returns the list head itself and the following tail->offset + tail->size reads memory past struct trace_event_class. The corrupted result is then used as the BPF context-size bound in __perf_event_set_bpf_prog(), which lets context-reading BPF programs attach to a zero-field tracepoint when they should be rejected with -EACCES. Reject such events at registration can fix this bug. event_init() is the universal chokepoint invoked for both early-boot and module events, and its return is enforced by __register_event(), which refuses to add the call to ftrace_events. An event whose fields_array[0].type is NULL (the empty-TP_STRUCT__entry sentinel) is rejected with -EINVAL before trace_event_get_offsets() can be reached. Dynamic events, which carry the TRACE_FUNCTION_TYPE marker in fields_array[0].type and populate the fields list lazily through a define_fields callback, are unaffected. Signed-off-by: Haoran Wang <[email protected]> --- kernel/trace/trace_events.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -3279,6 +3279,11 @@ static int event_init(struct trace_event_call *call) if (WARN_ON(!name)) return -EINVAL; + if (call->class->fields_array && + !call->class->fields_array[0].type && + !call->class->get_fields) + return -EINVAL; + if (call->class->raw_init) { ret = call->class->raw_init(call); if (ret < 0 && ret != -ENOSYS) -- 2.43.0
