Re: [BUG] tracing: __copy_from_user without access_ok leaks kernel memory in syscall fault tracing

[Steven Rostedt]

On Thu, 15 Oct 2026 20:05:57 +0800
Wang Haoran <haoranwangsec@xxxxxxxxx> wrote:

Please send this to linux-trace-kernel@xxxxxxxxxxxxxxx.

>  From ca4e2a6928bbd9010ebec967440517b08909b992 Mon Sep 17 00:00:00 2001
> From: Haoran Wang <haoranwangsec@xxxxxxxxx>
> Date: Thu, 15 Oct 2026 19:12:21 +0800
> Subject: [PATCH] tracing/syscalls: use copy_from_user for the faultable
>   syscall buffer
> 
> Here is a working fix for the report. The leak is not strictly root
> only, so there is a security concern on systems that relax
> perf_event_paranoid.

Leave out any security details.

Simply state that the current check is missing the access_ok.

That is, this is a very trivial bug with a simple fix and a simple change
log. It could be a security concern for machines that trust perf a bit too
much.

But to go upstream, it still needs to follow the process.

Thanks,

-- Steve