Re: [PATCH] tracing: guard trace_event_get_offsets() against an empty fields list

[Steven Rostedt]

On Thu, 15 Oct 2026 16:51:58 +0800
Haoran Wang <haoranwangsec@xxxxxxxxx> wrote:

> 6. Proof of Concept
> 
> The reproduction runs on 7.2.10 kernel. A custom-tracepoint module
> (zerofield_mod) registers a zero-field tracepoint (empty TP_STRUCT__entry)

The real fix is to reject any event with an empty TP_STRUCT__entry.

-- Steve


> and places an inert 64-byte 0x53 sentinel in .ref.data right after the
> 72-byte event_class global (GCC lays out same-section statics by
> descending size), so the kernel's OOB read of class+84/class+88 picks up
> 0x53535353 instead of zero section padding. The sentinel is inert data --
> it does not change kernel control flow or inject a bug; it only makes the
> pre-existing OOB read's effect observable (off becomes non-zero instead of
> silently zero, the latter being indistinguishable from a fixed kernel
> returning 0).