From: Steven Rostedt <rostedt@goodmis.org>
To: Haoran Wang <haoranwangsec@gmail.com>
Cc: mhiramat@kernel.org, linux-kernel@vger.kernel.org,
linux-trace-kernel@vger.kernel.org,
mathieu.desnoyers@efficios.com
Subject: Re: [PATCH] tracing: guard trace_event_get_offsets() against an empty fields list
Date: Thu, 15 Oct 2026 07:57:32 -0400 [thread overview]
Message-ID: <20261015075732.1a0e9bc6@226.227.38.69.naturalwireless.com> (raw)
In-Reply-To: <6ad09433.a938ce27.3282d8.5f98@mx.google.com>
On Thu, 15 Oct 2026 16:51:58 +0800
Haoran Wang <haoranwangsec@gmail.com> wrote:
> 6. Proof of Concept
>
> The reproduction runs on 7.2.10 kernel. A custom-tracepoint module
> (zerofield_mod) registers a zero-field tracepoint (empty TP_STRUCT__entry)
The real fix is to reject any event with an empty TP_STRUCT__entry.
-- Steve
> and places an inert 64-byte 0x53 sentinel in .ref.data right after the
> 72-byte event_class global (GCC lays out same-section statics by
> descending size), so the kernel's OOB read of class+84/class+88 picks up
> 0x53535353 instead of zero section padding. The sentinel is inert data --
> it does not change kernel control flow or inject a bug; it only makes the
> pre-existing OOB read's effect observable (off becomes non-zero instead of
> silently zero, the latter being indistinguishable from a fixed kernel
> returning 0).
prev parent reply other threads:[~2026-10-15 11:57 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-15 8:51 [PATCH] tracing: guard trace_event_get_offsets() against an empty fields list Haoran Wang
2026-10-15 9:14 ` sashiko-bot
2026-10-15 11:57 ` Steven Rostedt [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261015075732.1a0e9bc6@226.227.38.69.naturalwireless.com \
--to=rostedt@goodmis.org \
--cc=haoranwangsec@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-trace-kernel@vger.kernel.org \
--cc=mathieu.desnoyers@efficios.com \
--cc=mhiramat@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox