On Fri, 16 Oct 2026 14:57:22 +0800 Haoran Wang <[email protected]> wrote:
> From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 > From: Haoran Wang <[email protected]> > Date: Fri, 16 Oct 2026 15:10:00 +0800 > Subject: [PATCH] tracing: reject trace events with an empty TP_STRUCT__entry > > trace_event_get_offsets() unconditionally dereferences the first entry of > an event class's fields list through list_first_entry(). A tracepoint > that declares an empty TP_STRUCT__entry never populates that list. Its > fields_array holds only the terminating sentinel, so list_first_entry() > returns the list head itself and the following tail->offset + tail->size > reads memory past struct trace_event_class. The corrupted result is > then used as the BPF context-size bound in __perf_event_set_bpf_prog(), > which lets context-reading BPF programs attach to a zero-field tracepoint > when they should be rejected with -EACCES. > > Reject such events at registration to fix this bug. event_init() is the > universal chokepoint invoked for both early-boot and module events, and > its return is enforced by __register_event(), which refuses to add the call > to ftrace_events. An event whose fields_array[0].type is NULL (the > empty-TP_STRUCT__entry sentinel) is rejected with -EINVAL before > trace_event_get_offsets() can be reached. > BTW, what bug are you trying to solve? Just some theoretical bug you found from a static analyzer or AI? -- Steve
