[PATCH v2] tracing: Validate user addresses in faultable buffer copies

[Kyle Zeng]

trace_user_fault_read() uses __copy_from_user() when no custom copy
function is supplied. That primitive assumes the source address has
already been validated, but the helper only checks the destination
buffer size. A caller that passes an unchecked kernel address can
therefore cause mapped kernel memory to be copied into the tracing
buffer. The original syscall-array tracing implementation exposed this
path to syscall arguments before the syscall validated them.

Use copy_from_user() for the default copy as documented. Non-user
addresses then fail the copy and follow the existing NULL-return path.
Successful user copies, buffer bounds, and preemption and migration
retry rules are unchanged.

Fixes: 64cf7d058a005 ("tracing: Have trace_marker use per-cpu data to read user space")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Kyle Zeng <kylebot@xxxxxxxxxx>
---
v1: https://lore.kernel.org/r/20261006225221.54513-1-kylebot@xxxxxxxxxx
v2:
- Drop the trace_syscalls.c change, already fixed by 097fd0050089d.
- Keep only the trace.c change requested by Steven Rostedt.
- Point Fixes at the commit that introduced the shared helper's copy.

 kernel/trace/trace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 4ccdefb5c3ef..e1127768c074 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -6289,7 +6289,7 @@ char *trace_user_fault_read(struct trace_user_buf_info *tinfo,
 		if (copy_func) {
 			ret = copy_func(buffer, ptr, size, data);
 		} else {
-			ret = __copy_from_user(buffer, ptr, size);
+			ret = copy_from_user(buffer, ptr, size);
 		}
 
 		preempt_disable_notrace();

base-commit: b3dfbde62cf1981c4638939c159dfd087b7a72e9
-- 
2.55.0.openai.911.g06873a30d2f3