[v1] fix NULL dereference in event_trigger_reset_filter()

[PATCH] fix NULL dereference in event_trigger_reset_filter()

Posted by Alexander Konyukhov 1 week, 5 days ago

Fixes a null pointer dereference in the trace events subsystem. 
When trigger_data_alloc() returns NULL, the original code jumps to out_free,
invoking event_trigger_reset_filter() with a NULL pointer. 
This propagates through set_trigger_filter() and dereferences data->filter_str 
with data == NULL in trace_events_trigger.c.

The patch adds out_hist_data, rerouting allocation failures to skip 
event_trigger_reset_filter() on NULL and clean up via remove_hist_vars(hist_data).

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 4b147936fa50 ("tracing: Add support for 'synthetic' events")
Signed-off-by: Alexander Konyukhov <Alexander.Konyukhov@kaspersky.com>
---
 kernel/trace/trace_events_hist.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index 336fc54d8ec8..9d203ab56fac 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -6525,7 +6525,7 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops,
 	trigger_data = trigger_data_alloc(cmd_ops, cmd, param, hist_data);
 	if (!trigger_data) {
 		ret = -ENOMEM;
-		goto out_free;
+		goto out_hist_data;
 	}
 
 	ret = event_trigger_set_filter(cmd_ops, file, filter, trigger_data);
@@ -6591,6 +6591,7 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops,
 	event_trigger_unregister(cmd_ops, file, glob+1, trigger_data);
  out_free:
 	event_trigger_reset_filter(cmd_ops, trigger_data);
+ out_hist_data:
 
 	remove_hist_vars(hist_data);
 
-- 
2.43.0

Re: [PATCH] fix NULL dereference in event_trigger_reset_filter()

Posted by Steven Rostedt 1 week, 5 days ago

On Mon, 13 Jul 2026 17:50:54 +0300
Alexander Konyukhov <Alexander.Konyukhov@kaspersky.com> wrote:

> Fixes a null pointer dereference in the trace events subsystem. 
> When trigger_data_alloc() returns NULL, the original code jumps to out_free,
> invoking event_trigger_reset_filter() with a NULL pointer. 
> This propagates through set_trigger_filter() and dereferences data->filter_str 
> with data == NULL in trace_events_trigger.c.
> 
> The patch adds out_hist_data, rerouting allocation failures to skip 
> event_trigger_reset_filter() on NULL and clean up via remove_hist_vars(hist_data).
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.

What kernel are you using?

> 
> Fixes: 4b147936fa50 ("tracing: Add support for 'synthetic' events")
> Signed-off-by: Alexander Konyukhov <Alexander.Konyukhov@kaspersky.com>
> ---
>  kernel/trace/trace_events_hist.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
> index 336fc54d8ec8..9d203ab56fac 100644
> --- a/kernel/trace/trace_events_hist.c
> +++ b/kernel/trace/trace_events_hist.c
> @@ -6525,7 +6525,7 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops,
>  	trigger_data = trigger_data_alloc(cmd_ops, cmd, param, hist_data);
>  	if (!trigger_data) {
>  		ret = -ENOMEM;
> -		goto out_free;
> +		goto out_hist_data;
>  	}
>  
>  	ret = event_trigger_set_filter(cmd_ops, file, filter, trigger_data);
> @@ -6591,6 +6591,7 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops,
>  	event_trigger_unregister(cmd_ops, file, glob+1, trigger_data);
>   out_free:
>  	event_trigger_reset_filter(cmd_ops, trigger_data);

The above has been removed by commit a4e0ea0e10a2 ("tracing: Remove
redundant call to event_trigger_reset_filter() in event_hist_trigger_parse()")

-- Steve


> + out_hist_data:
>  
>  	remove_hist_vars(hist_data);
>