On Fri, Oct 16, 2026 at 10:51:00AM -0400, Steven Rostedt wrote: > On Fri, 16 Oct 2026 10:22:56 -0400 > Steven Rostedt <[email protected]> wrote: > > > On Fri, 16 Oct 2026 17:47:51 +0800 > > Haoran Wang <[email protected]> wrote: > > > > > From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 > > > From: Haoran Wang <[email protected]> > > > Date: Fri, 16 Oct 2026 16:30:00 +0800 > > > Subject: [PATCH] tracing: guard trace_event_get_offsets() against an > > > empty fields list > > > > > > trace_event_get_offsets() dereferences the first entry of the fields list > > > returned by trace_get_fields() via list_first_entry(). list_first_entry() > > > then returns the list head itself, and tail->offset + tail->size reads > > > past > > > it. The corrupted result is used as the BPF context-size bound in > > > __perf_event_set_bpf_prog(): > > > > > > int off = trace_event_get_offsets(event->tp_event); > > > if (prog->aux->max_ctx_offset > off) > > > return -EACCES; > > > > > > so a context-reading BPF program that ought to be rejected can instead be > > > attached to a zero-field tracepoint (which still carries > > > TRACE_EVENT_FL_TRACEPOINT) and read adjacent kernel memory when the > > > tracepoint fires, bypassing the verifier's context-size confinement. > > > > > > This is reachable through user_events: a user can register an event with > > > no > > > fields (e.g. `echo u:my_event > dynamic_events`), which leaves > > > user->fields > > > empty while the event remains a BPF-attachable tracepoint, > > > trace_get_fields() then routes through user_event_get_fields() to that > > > empty list. The corrupted > > > result after list_first_entry is then used as the BPF context-size bound > > > in > > > __perf_event_set_bpf_prog(), which lets context-reading BPF programs > > > attach > > > to a zero-field tracepoint when they should be rejected with -EACCES. > > > > > > > Hmm, so user events can have empty events. :-/ > > I meant "empty fields". > > > > > Beau, Is that a thing? >
There have been events in the past that are used simply to signal something has happened and have no payload/fields. That is a valid scenario from previous discussions with folks on our side, yes. Thanks, -Beau > -- Steve
