diff options
| author | Haoran Wang <haoranwangsec@gmail.com> | 2026-10-16 16:30:00 +0800 |
|---|---|---|
| committer | Steven Rostedt <rostedt@goodmis.org> | 2026-10-23 13:31:10 -0400 |
| commit | c0c7c3f9d2e7d9ecc44e536d6f39f44b1faf6044 (patch) | |
| tree | e275049bbc89ae8d17e869979ce243e351ad0335 /kernel/trace | |
| parent | 107b87efc8fcd6a597f1b534f116385620770e56 (diff) | |
tracing: Guard trace_event_get_offsets() against an empty fields list
trace_event_get_offsets() dereferences the first entry of the fields list
returned by trace_get_fields() via list_first_entry(). list_first_entry()
then returns the list head itself, and tail->offset + tail->size reads past
it. The corrupted result is used as the BPF context-size bound in
__perf_event_set_bpf_prog():
int off = trace_event_get_offsets(event->tp_event);
if (prog->aux->max_ctx_offset > off)
return -EACCES;
so a context-reading BPF program that ought to be rejected can instead be
attached to a zero-field tracepoint (which still carries
TRACE_EVENT_FL_TRACEPOINT) and read adjacent kernel memory when the
tracepoint fires, bypassing the verifier's context-size confinement.
This is reachable through user_events: a user can register an event with no
fields (e.g. `echo u:my_event > dynamic_events`), which leaves user->fields
empty while the event remains a BPF-attachable tracepoint,
trace_get_fields() then routes through user_event_get_fields() to that
empty list. The corrupted
result after list_first_entry is then used as the BPF context-size bound in
__perf_event_set_bpf_prog(), which lets context-reading BPF programs attach
to a zero-field tracepoint when they should be rejected with -EACCES.
Add list empty check to fix this bug.
Link: https://patch.msgid.link/6ad1f2ca.6048f038.32d739.a530@mx.google.com
Signed-off-by: Haoran Wang <haoranwangsec@gmail.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Diffstat (limited to 'kernel/trace')
| -rw-r--r-- | kernel/trace/trace_events.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index a1ac2a02f4e2..6afed2091e19 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -246,6 +246,10 @@ int trace_event_get_offsets(struct trace_event_call *call) struct list_head *head; head = trace_get_fields(call); + + if (list_empty(head)) + return sizeof(struct trace_entry); + /* * head->next points to the last field with the largest offset, * since it was added last by trace_define_field() |