[PATCH] tracing: Validate user addresses in faultable buffer copies

Syscall entry tracing runs before the syscall implementation validates
its arguments. For a size-bearing user argument,
syscall_copy_user_array() passes the register-supplied pointer directly
to __copy_from_user(), which assumes the user address has already been
checked. On x86-64 this can copy mapped kernel memory into the raw event.
An unprivileged task can open a task-bound sys_enter_write perf event at
perf_event_paranoid=2 and disclose that memory with a write() that even
fails with EBADF.

Use copy_from_user() for each actual array pointer. Use it in the default
trace_user_fault_read() path as well: the original syscall-array tracing
implementation used that path, and the helper is documented to use
copy_from_user(). Keep the existing length limits and per-argument fault
handling, so valid user data is recorded as before and failed copies do
not contribute bytes to the event.

Fixes: b4f7624cfc94 ("tracing: Have system call events record user array data")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-6-astra
Signed-off-by: Kyle Zeng <redacted>
---
 kernel/trace/trace.c          | 2 +-
 kernel/trace/trace_syscalls.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index e4a490d3d08c..07acbc44d99c 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c

@@ -6263,7 +6263,7 @@ char *trace_user_fault_read(struct trace_user_buf_info *tinfo,
 		if (copy_func) {
 			ret = copy_func(buffer, ptr, size, data);
 		} else {
-			ret = __copy_from_user(buffer, ptr, size);
+			ret = copy_from_user(buffer, ptr, size);
 		}
 
 		preempt_disable_notrace();

diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
index e35744049e3f..d9190fdc030d 100644
--- a/kernel/trace/trace_syscalls.c
+++ b/kernel/trace/trace_syscalls.c

@@ -683,7 +683,7 @@ static int syscall_copy_user_array(char *buf, const char __user *ptr,
 
 	for (int i = 0; i < args->uargs; i++, buf += SYSCALL_FAULT_ARG_SZ) {
 		ptr = (char __user *)args->ptr_array[i];
-		ret = __copy_from_user(buf, ptr, size);
+		ret = copy_from_user(buf, ptr, size);
 		args->read[i] = ret ? -1 : size;
 	}
 	return 0;

-- 
2.53.0