On Thu, Oct 15, 2026 at 03:01:08PM +0800, Haoran Wang wrote: > I'd like to report an issue in kernel/trace/trace_syscalls.c:686 (function > syscall_copy_user_array), found via static analysis of Linux 7.0.11 and > verified against the 7.2.10 source tree. I have reproduced the leak on an > 7.2.10 kernel.
Cool, but you forgot to also provide a working patch for this? > 1. Summary > The "syscall fault tracing" feature (added in 7.0, CONFIG_FTRACE_SYSCALLS) > treats the raw syscall argument args[1] (the buffer pointer) of faultable > syscalls (write/pwrite64/ mq_timedsend) as a user address and copies it > with __copy_from_user(buf, args[1], size) without an access_ok() check. > When a traced process calls write(fd, <kernel address>, count), the > sys_enter tracepoint fires before vfs_write's access_ok and > __copy_from_user copies up to 165 bytes from that kernel address into the > per-CPU trace buffer, which is appended to the sys_enter_write event and > readable from /sys/kernel/tracing/trace. The write() itself then returns > EFAULT, but the leak is already complete. copy_from_user() would have > rejected a kernel address via access_ok(); __copy_from_user() does not. This is root-only, so there's no security issue really, right? Or am I mistaken? thanks, greg k-h
