Re: [PATCH] tracing: reject trace events with an empty TP_STRUCT__entry

[Steven Rostedt <rostedt@goodmis.org>]

On Fri, 16 Oct 2026 14:57:22 +0800
Haoran Wang <haoranwangsec@gmail.com> wrote:

> From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
> From: Haoran Wang <haoranwangsec@gmail.com>
> Date: Fri, 16 Oct 2026 15:10:00 +0800
> Subject: [PATCH] tracing: reject trace events with an empty TP_STRUCT__entry
> 
> trace_event_get_offsets() unconditionally dereferences the first entry of
> an event class's fields list through list_first_entry().  A tracepoint
> that declares an empty TP_STRUCT__entry never populates that list. Its
> fields_array holds only the terminating sentinel, so list_first_entry()
> returns the list head itself and the following tail->offset + tail->size
> reads memory past struct trace_event_class.  The corrupted result is
> then used as the BPF context-size bound in __perf_event_set_bpf_prog(),
> which lets context-reading BPF programs attach to a zero-field tracepoint
> when they should be rejected with -EACCES.
> 
> Reject such events at registration to fix this bug. event_init() is the
> universal chokepoint invoked for both early-boot and module events, and
> its return is enforced by __register_event(), which refuses to add the call
> to ftrace_events.  An event whose fields_array[0].type is NULL (the
> empty-TP_STRUCT__entry sentinel) is rejected with -EINVAL before
> trace_event_get_offsets() can be reached.
> 

BTW, what bug are you trying to solve? Just some theoretical bug you found
from a static analyzer or AI?

-- Steve