[PATCH] tracing: Validate user addresses in faultable buffer copies

[PATCH] tracing: Validate user addresses in faultable buffer copies

[Kyle Zeng]

Syscall entry tracing runs before the syscall implementation validates
its arguments. For a size-bearing user argument,
syscall_copy_user_array() passes the register-supplied pointer directly
to __copy_from_user(), which assumes the user address has already been
checked. On x86-64 this can copy mapped kernel memory into the raw event.
An unprivileged task can open a task-bound sys_enter_write perf event at
perf_event_paranoid=2 and disclose that memory with a write() that even
fails with EBADF.

Use copy_from_user() for each actual array pointer. Use it in the default
trace_user_fault_read() path as well: the original syscall-array tracing
implementation used that path, and the helper is documented to use
copy_from_user(). Keep the existing length limits and per-argument fault
handling, so valid user data is recorded as before and failed copies do
not contribute bytes to the event.

Fixes: b4f7624cfc94 ("tracing: Have system call events record user array data")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-6-astra
Signed-off-by: Kyle Zeng <kylebot@openai.com>
---
 kernel/trace/trace.c          | 2 +-
 kernel/trace/trace_syscalls.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index e4a490d3d08c..07acbc44d99c 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -6263,7 +6263,7 @@ char *trace_user_fault_read(struct trace_user_buf_info *tinfo,
 		if (copy_func) {
 			ret = copy_func(buffer, ptr, size, data);
 		} else {
-			ret = __copy_from_user(buffer, ptr, size);
+			ret = copy_from_user(buffer, ptr, size);
 		}
 
 		preempt_disable_notrace();
diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
index e35744049e3f..d9190fdc030d 100644
--- a/kernel/trace/trace_syscalls.c
+++ b/kernel/trace/trace_syscalls.c
@@ -683,7 +683,7 @@ static int syscall_copy_user_array(char *buf, const char __user *ptr,
 
 	for (int i = 0; i < args->uargs; i++, buf += SYSCALL_FAULT_ARG_SZ) {
 		ptr = (char __user *)args->ptr_array[i];
-		ret = __copy_from_user(buf, ptr, size);
+		ret = copy_from_user(buf, ptr, size);
 		args->read[i] = ret ? -1 : size;
 	}
 	return 0;
-- 
2.53.0

Re: [PATCH] tracing: Validate user addresses in faultable buffer copies

[Steven Rostedt]

On Tue,  6 Oct 2026 15:52:21 -0700
Kyle Zeng <kylebot@openai.com> wrote:

> Syscall entry tracing runs before the syscall implementation validates
> its arguments. For a size-bearing user argument,
> syscall_copy_user_array() passes the register-supplied pointer directly
> to __copy_from_user(), which assumes the user address has already been
> checked. On x86-64 this can copy mapped kernel memory into the raw event.
> An unprivileged task can open a task-bound sys_enter_write perf event at
> perf_event_paranoid=2 and disclose that memory with a write() that even
> fails with EBADF.
> 
> Use copy_from_user() for each actual array pointer. Use it in the default
> trace_user_fault_read() path as well: the original syscall-array tracing
> implementation used that path, and the helper is documented to use
> copy_from_user(). Keep the existing length limits and per-argument fault
> handling, so valid user data is recorded as before and failed copies do
> not contribute bytes to the event.
> 
> Fixes: b4f7624cfc94 ("tracing: Have system call events record user array data")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:gpt-6-astra
> Signed-off-by: Kyle Zeng <kylebot@openai.com>
> ---
>  kernel/trace/trace.c          | 2 +-
>  kernel/trace/trace_syscalls.c | 2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
> index e4a490d3d08c..07acbc44d99c 100644
> --- a/kernel/trace/trace.c
> +++ b/kernel/trace/trace.c
> @@ -6263,7 +6263,7 @@ char *trace_user_fault_read(struct trace_user_buf_info *tinfo,
>  		if (copy_func) {
>  			ret = copy_func(buffer, ptr, size, data);
>  		} else {
> -			ret = __copy_from_user(buffer, ptr, size);
> +			ret = copy_from_user(buffer, ptr, size);
>  		}
>  
>  		preempt_disable_notrace();
> diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
> index e35744049e3f..d9190fdc030d 100644
> --- a/kernel/trace/trace_syscalls.c
> +++ b/kernel/trace/trace_syscalls.c
> @@ -683,7 +683,7 @@ static int syscall_copy_user_array(char *buf, const char __user *ptr,
>  
>  	for (int i = 0; i < args->uargs; i++, buf += SYSCALL_FAULT_ARG_SZ) {
>  		ptr = (char __user *)args->ptr_array[i];
> -		ret = __copy_from_user(buf, ptr, size);
> +		ret = copy_from_user(buf, ptr, size);

This was fixed by:

  097fd0050089d ("tracing/syscalls: Use copy_from_user for the faultable syscall buffer")

as I missed your patch. But the other one still needs to be updated.

Care to send a v2 that just updates the trace.c file?

Thanks,

-- Steve



>  		args->read[i] = ret ? -1 : size;
>  	}
>  	return 0;