Re: [BUG] tracing: __copy_from_user without access_ok leaks kernel memory in syscall fault tracing

[Greg KH <gregkh@linuxfoundation.org>]

On Thu, Oct 15, 2026 at 03:01:08PM +0800, Haoran Wang wrote:
> I'd like to report an issue in kernel/trace/trace_syscalls.c:686 (function
> syscall_copy_user_array), found via static analysis of Linux 7.0.11 and
> verified against the 7.2.10 source tree. I have reproduced the leak on an
> 7.2.10 kernel.

Cool, but you forgot to also provide a working patch for this?

> 1. Summary
> The "syscall fault tracing" feature (added in 7.0, CONFIG_FTRACE_SYSCALLS)
> treats the raw syscall argument args[1] (the buffer pointer) of faultable
> syscalls (write/pwrite64/ mq_timedsend) as a user address and copies it
> with __copy_from_user(buf, args[1], size) without an access_ok() check.
> When a traced process calls write(fd, <kernel address>, count), the
> sys_enter tracepoint fires before vfs_write's access_ok and
> __copy_from_user copies up to 165 bytes from that kernel address into the
> per-CPU trace buffer, which is appended to the sys_enter_write event and
> readable from /sys/kernel/tracing/trace. The write() itself then returns
> EFAULT, but the leak is already complete. copy_from_user() would have
> rejected a kernel address via access_ok(); __copy_from_user() does not.

This is root-only, so there's no security issue really, right?  Or am I
mistaken?

thanks,

greg k-h