[PATCH] tracing: reject trace events with an empty TP_STRUCT__entry

[Haoran Wang <haoranwangsec@gmail.com>]

From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Haoran Wang <haoranwangsec@gmail.com>
Date: Fri, 16 Oct 2026 15:10:00 +0800
Subject: [PATCH] tracing: reject trace events with an empty TP_STRUCT__entry

trace_event_get_offsets() unconditionally dereferences the first entry of
an event class's fields list through list_first_entry().  A tracepoint
that declares an empty TP_STRUCT__entry never populates that list. Its
fields_array holds only the terminating sentinel, so list_first_entry()
returns the list head itself and the following tail->offset + tail->size
reads memory past struct trace_event_class.  The corrupted result is
then used as the BPF context-size bound in __perf_event_set_bpf_prog(),
which lets context-reading BPF programs attach to a zero-field tracepoint
when they should be rejected with -EACCES.

Reject such events at registration to fix this bug. event_init() is the
universal chokepoint invoked for both early-boot and module events, and
its return is enforced by __register_event(), which refuses to add the call
to ftrace_events.  An event whose fields_array[0].type is NULL (the
empty-TP_STRUCT__entry sentinel) is rejected with -EINVAL before
trace_event_get_offsets() can be reached.

Signed-off-by: Haoran Wang <haoranwangsec@gmail.com>
---
 kernel/trace/trace_events.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -3279,6 +3279,10 @@ static int event_init(struct trace_event_call *call)
 	if (WARN_ON(!name))
 		return -EINVAL;
 
+	if (call->class->fields_array &&
+	    !call->class->fields_array[0].type)
+		return -EINVAL;
+
 	if (call->class->raw_init) {
 		ret = call->class->raw_init(call);
 		if (ret < 0 && ret != -ENOSYS)
-- 
2.43.0