Re: [PATCH] tracing: guard trace_event_get_offsets() against an empty fields list

[Beau Belgrave <beaub@linux.microsoft.com>]

On Fri, Oct 16, 2026 at 10:51:00AM -0400, Steven Rostedt wrote:
> On Fri, 16 Oct 2026 10:22:56 -0400
> Steven Rostedt <rostedt@goodmis.org> wrote:
> 
> > On Fri, 16 Oct 2026 17:47:51 +0800
> > Haoran Wang <haoranwangsec@gmail.com> wrote:
> > 
> > > From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
> > > From: Haoran Wang <haoranwangsec@gmail.com>
> > > Date: Fri, 16 Oct 2026 16:30:00 +0800
> > > Subject: [PATCH] tracing: guard trace_event_get_offsets() against an empty fields list
> > > 
> > > trace_event_get_offsets() dereferences the first entry of the fields list
> > > returned by trace_get_fields() via list_first_entry().  list_first_entry()
> > > then returns the list head itself, and tail->offset + tail->size reads past
> > > it.  The corrupted result is used as the BPF context-size bound in
> > > __perf_event_set_bpf_prog():
> > > 
> > >     int off = trace_event_get_offsets(event->tp_event);
> > >     if (prog->aux->max_ctx_offset > off)
> > >             return -EACCES;
> > > 
> > > so a context-reading BPF program that ought to be rejected can instead be
> > > attached to a zero-field tracepoint (which still carries
> > > TRACE_EVENT_FL_TRACEPOINT) and read adjacent kernel memory when the
> > > tracepoint fires, bypassing the verifier's context-size confinement.
> > > 
> > > This is reachable through user_events: a user can register an event with no
> > > fields (e.g. `echo u:my_event > dynamic_events`), which leaves user->fields
> > > empty while the event remains a BPF-attachable tracepoint,
> > > trace_get_fields() then routes through user_event_get_fields() to that
> > > empty list. The corrupted
> > > result after list_first_entry is then used as the BPF context-size bound in
> > > __perf_event_set_bpf_prog(), which lets context-reading BPF programs attach
> > > to a zero-field tracepoint when they should be rejected with -EACCES.
> > >   
> > 
> > Hmm, so user events can have empty events. :-/
> 
> I meant "empty fields".
> 
> > 
> > Beau, Is that a thing?
> 

There have been events in the past that are used simply to signal
something has happened and have no payload/fields. That is a valid
scenario from previous discussions with folks on our side, yes.

Thanks,
-Beau

> -- Steve