Re: [BUG] tracing: __copy_from_user without access_ok leaks kernel memory in syscall fault tracing

[Steven Rostedt]

On Thu, 15 Oct 2026 09:42:09 -0400
Steven Rostedt <rostedt@xxxxxxxxxxx> wrote:

> On Thu, 15 Oct 2026 20:05:57 +0800
> Wang Haoran <haoranwangsec@xxxxxxxxx> wrote:
> 
> Please send this to linux-trace-kernel@xxxxxxxxxxxxxxx.
> 
> >  From ca4e2a6928bbd9010ebec967440517b08909b992 Mon Sep 17 00:00:00 2001
> > From: Haoran Wang <haoranwangsec@xxxxxxxxx>
> > Date: Thu, 15 Oct 2026 19:12:21 +0800
> > Subject: [PATCH] tracing/syscalls: use copy_from_user for the faultable
> >   syscall buffer
> > 
> > Here is a working fix for the report. The leak is not strictly root
> > only, so there is a security concern on systems that relax
> > perf_event_paranoid.  
> 
> Leave out any security details.
> 
> Simply state that the current check is missing the access_ok.
> 
> That is, this is a very trivial bug with a simple fix and a simple change
> log. It could be a security concern for machines that trust perf a bit too
> much.
> 
> But to go upstream, it still needs to follow the process.
> 

Heh, I just noticed that you *did* Cc upstream (in this email!). But
because you didn't have "[PATCH]" in the topic, it still didn't make it to
patchwork.

Can you please send a proper patch.

Thanks,

-- Steve