[PATCH] perf/core: Require kernel access for page-size samples

[Kyle Zeng]

PERF_SAMPLE_CODE_PAGE_SIZE and PERF_SAMPLE_DATA_PAGE_SIZE translate a
sampled virtual address using the current task's page tables, including
kernel mappings.  exclude_kernel only filters the execution mode of the
sample; it does not establish that the address being translated belongs
to userspace.

For example, an unprivileged tracer can put a kernel address in a
tracee's saved IP at a syscall-entry stop.  A following syscall perf
tracepoint still sees user-mode registers and reports the page size at
that address.  The distinction between unmapped and mapped addresses
can disclose the randomized kernel image base even at
perf_event_paranoid=2.

Require perf_allow_kernel() for both page-size sample types, as is
already done for PERF_SAMPLE_PHYS_ADDR.  This applies the existing perf
and LSM authorization policy before the event is created, independently
of the source or representation of the sampled address.  Authorized
page-size sampling and events that do not request these translation
fields are unchanged.

Fixes: 8d97e71811aa ("perf/core: Add PERF_SAMPLE_DATA_PAGE_SIZE")
Fixes: 995f088efebe ("perf/core: Add support for PERF_SAMPLE_CODE_PAGE_SIZE")
Assisted-by: Codex:gpt-6-astra
Signed-off-by: Kyle Zeng <kylebot@xxxxxxxxxx>
---
 kernel/events/core.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index db7b76d6b68aa55dbe95e594d98a47230d12e979..97e5db887bd0a6e45437674670bc38efc6d7d9be 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -13967,8 +13967,13 @@ SYSCALL_DEFINE5(perf_event_open,
 			return -EINVAL;
 	}
 
-	/* Only privileged users can get physical addresses */
-	if ((attr.sample_type & PERF_SAMPLE_PHYS_ADDR)) {
+	/*
+	 * Address translation can disclose kernel mappings even when the
+	 * sampled registers are from user mode.
+	 */
+	if (attr.sample_type & (PERF_SAMPLE_PHYS_ADDR |
+				PERF_SAMPLE_DATA_PAGE_SIZE |
+				PERF_SAMPLE_CODE_PAGE_SIZE)) {
 		err = perf_allow_kernel();
 		if (err)
 			return err;

base-commit: fd179f8a05be3ccae366b9b96e176b51fbe54aab