Re: [PATCH v2] perf: enable unprivileged syscall tracing with perf trace

[sashiko-bot@kernel.org]

Sashiko AI review found 1 potential issue(s):
- [High] The kaddr_leak mask in perf_event_open() fails to block PERF_SAMPLE_IP and PERF_SAMPLE_REGS_INTR, allowing unprivileged users to bypass KASLR and leak kernel register state.
--

commit d9060ee10098244bcdd4bf26d128fe8ae6f9f578
Author: Anubhav Shelat <ashelat@redhat.com>

perf: enable unprivileged syscall tracing with perf trace

This patch allows unprivileged users to trace their own processes' syscalls
using perf trace by relaxing the perf_allow_kernel() check for task-attached
tracepoint events. It attempts to prevent KASLR bypasses by blocking sample
types that expose kernel addresses.

> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index 6d1f8bad7e1c5..07d67d95af96f 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -13833,9 +13833,25 @@ SYSCALL_DEFINE5(perf_event_open,
>  		return err;
>  
>  	if (!attr.exclude_kernel) {
> -		err = perf_allow_kernel();
> -		if (err)
> -			return err;
> +		bool tp_bypass = false;
> +
> +		if (attr.type == PERF_TYPE_TRACEPOINT && pid != -1) {
> +			/*
> +			 * Block sample types that expose kernel addresses to
> +			 * prevent KASLR bypass
> +			 */
> +			u64 kaddr_leak = PERF_SAMPLE_CALLCHAIN |
> +					 PERF_SAMPLE_BRANCH_STACK |
> +					 PERF_SAMPLE_ADDR;

Does this kaddr_leak mask need to include PERF_SAMPLE_IP and
PERF_SAMPLE_REGS_INTR?

If an unprivileged user requests a task-attached tracepoint event with
exclude_kernel=0 and specifies PERF_SAMPLE_IP or PERF_SAMPLE_REGS_INTR,
tp_bypass will evaluate to true and the perf_allow_kernel() check will be
skipped.

When the tracepoint fires in kernel mode, won't the user receive samples
containing the kernel instruction pointer and full CPU register state,
allowing a KASLR bypass?

> +
> +			tp_bypass = !(attr.sample_type & kaddr_leak);
> +		}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260410133529.21947-1-ashelat@redhat.com?part=1