From nobody Sat Jul 25 21:21:33 2026 Received: from mx15.kaspersky-labs.com (mx15.kaspersky-labs.com [46.165.235.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A1A95409E01 for ; Mon, 13 Jul 2026 14:51:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=46.165.235.169 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783954264; cv=none; b=IbRNR1fqrNLeNHYH4oa/y9gEboG8wzBRdfe/egh4nPnbQkOCQRBT38hm/vJLV77jhNvJbigoM5KSE2WopAg7zasj3/A6hkZa9sCbkrmJDye5ermvrDF3x88lYXA4XsGkW9D0ku6g42ra2kLR708o09EGkj0uGoDCyjOwbxxET2Y= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783954264; c=relaxed/simple; bh=a/YgShlWYe0zaZJr9d7iz/uOC/F6a/HwgO71DjyEUjM=; h=From:To:CC:Subject:Date:Message-ID:MIME-Version:Content-Type; b=df//upDx+FLPw01BkBwKoSm844dMmTZs4T5JpQsfUBxb+/hZPBSH55JAq/JEL93VhgqwUDpNhe0Mf32ETaOrRgS8R6JhI2x7xA6Cyv/UILfp/KVNZdZWxZgzyIVFmDOM2XSYmt0k4OxpSHdXixz8vW37iKmbR32QHNBAcgpOyVU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=kaspersky.com; spf=pass smtp.mailfrom=kaspersky.com; dkim=pass (2048-bit key) header.d=kaspersky.com header.i=@kaspersky.com header.b=RxZBRwch; arc=none smtp.client-ip=46.165.235.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=kaspersky.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kaspersky.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kaspersky.com header.i=@kaspersky.com header.b="RxZBRwch" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kaspersky.com; s=mail202505; t=1783954258; bh=rQo+4cmBKmHb+Ylk15+OIwRc4hLyTGheSx7BEGkWPwk=; h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type; b=RxZBRwchkmrHRWg5NDrURAUb9Mm1aEUODpmBwAb1YBhBKPI6fjlVOGje0AbLEtW4j 4ZtftwLPcLtSAhMZssjk0NWG6aDWscEs47Jw7gHEJSlsfvnqS4rN5++i4uhfL3HZHX gUwT9UZq7vJOPB1oMmX+jIYK31vuOM2tDf2Y4dXa7u6oakbdBb9hHZ5z3tj87Dr+/G U4Nn5uAdV9ru5/H9lTjWEoZxQcmPikULomw5jrhz0LTgZ1eWNyx4tMrZWTHvEIxzuN whxgS961q9IVue6XtX3yccbgT0grsDer5+obIwDaiM88slnUXsGLlQTKAdHI5kQPiO NyBHJE0pK+CIg== Received: from relay15.kaspersky-labs.com (localhost [127.0.0.1]) by relay15.kaspersky-labs.com (Postfix) with ESMTP id BA85DA10B6; Mon, 13 Jul 2026 17:50:58 +0300 (MSK) Received: from mail-hq2.kaspersky.com (unknown [91.103.66.208]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mail-hq2.kaspersky.com", Issuer "Kaspersky MailRelays CA G3" (verified OK)) by mailhub15.kaspersky-labs.com (Postfix) with ESMTPS id 9A0B1A1158; Mon, 13 Jul 2026 17:50:58 +0300 (MSK) Received: from konyukhov.avp.ru (10.16.104.193) by HQMAILSRV1.avp.ru (10.64.57.51) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.2562.41; Mon, 13 Jul 2026 17:50:57 +0300 From: Alexander Konyukhov To: , CC: , , Alexander Konyukhov Subject: [PATCH] fix NULL dereference in event_trigger_reset_filter() Date: Mon, 13 Jul 2026 17:50:54 +0300 Message-ID: <20260713145054.2731267-1-Alexander.Konyukhov@kaspersky.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: HQMAILSRV1.avp.ru (10.64.57.51) To HQMAILSRV1.avp.ru (10.64.57.51) X-KSE-ServerInfo: HQMAILSRV1.avp.ru, 9 X-KSE-AntiSpam-Interceptor-Info: scan successful X-KSE-AntiSpam-Version: 6.1.1, Database issued on: 07/13/2026 14:32:45 X-KSE-AntiSpam-Status: KAS_STATUS_NOT_DETECTED X-KSE-AntiSpam-Method: none X-KSE-AntiSpam-Rate: 0 X-KSE-AntiSpam-Info: Lua profiles 204401 [Jul 13 2026] X-KSE-AntiSpam-Info: Version: 6.1.1.22 X-KSE-AntiSpam-Info: Envelope from: Alexander.Konyukhov@kaspersky.com X-KSE-AntiSpam-Info: LuaCore: 112 0.3.112 7c8d497b0e572fbfa504a2ee62037c045a8cb4ec X-KSE-AntiSpam-Info: {Tracking_ml_letters} X-KSE-AntiSpam-Info: {Tracking_cluster_exceptions} X-KSE-AntiSpam-Info: {Tracking_real_kaspersky_domains} X-KSE-AntiSpam-Info: {Tracking_black_eng_exceptions} X-KSE-AntiSpam-Info: {Tracking_from_domain_doesnt_match_to} X-KSE-AntiSpam-Info: 127.0.0.199:7.1.2;d41d8cd98f00b204e9800998ecf8427e.com:7.1.1;konyukhov.avp.ru:7.1.1,5.0.1;kaspersky.com:7.1.1,5.0.1 X-KSE-AntiSpam-Info: {Tracking_white_helo} X-KSE-AntiSpam-Info: FromAlignment: s X-KSE-AntiSpam-Info: Rate: 0 X-KSE-AntiSpam-Info: Status: not_detected X-KSE-AntiSpam-Info: Method: none X-KSE-Antiphishing-Info: Clean X-KSE-Antiphishing-ScanningType: Deterministic X-KSE-Antiphishing-Method: None X-KSE-Antiphishing-Bases: 07/13/2026 14:36:00 X-KSE-AttachmentFiltering-Interceptor-Info: no applicable attachment filtering rules found X-KSE-Antivirus-Interceptor-Info: scan successful X-KSE-Antivirus-Info: Clean, bases: 7/13/2026 1:10:00 PM X-KSE-BulkMessagesFiltering-Scan-Result: InTheLimit X-KSE-AttachmentFiltering-Interceptor-Info: no applicable attachment filtering rules found X-KSE-BulkMessagesFiltering-Scan-Result: InTheLimit X-KSMG-AntiPhishing: NotDetected X-KSMG-AntiSpam-Interceptor-Info: not scanned X-KSMG-AntiSpam-Status: not scanned, disabled by settings X-KSMG-AntiVirus: Kaspersky Secure Mail Gateway, version 2.1.1.8310, bases: 2026/07/13 11:40:00 #28431671 X-KSMG-AntiVirus-Status: NotDetected, skipped X-KSMG-LinksScanning: NotDetected X-KSMG-Message-Action: skipped X-KSMG-Rule-ID: 52 Content-Type: text/plain; charset="utf-8" Fixes a null pointer dereference in the trace events subsystem.=20 When trigger_data_alloc() returns NULL, the original code jumps to out_free, invoking event_trigger_reset_filter() with a NULL pointer.=20 This propagates through set_trigger_filter() and dereferences data->filter_= str=20 with data =3D=3D NULL in trace_events_trigger.c. The patch adds out_hist_data, rerouting allocation failures to skip=20 event_trigger_reset_filter() on NULL and clean up via remove_hist_vars(hist= _data). Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 4b147936fa50 ("tracing: Add support for 'synthetic' events") Signed-off-by: Alexander Konyukhov --- kernel/trace/trace_events_hist.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_h= ist.c index 336fc54d8ec8..9d203ab56fac 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -6525,7 +6525,7 @@ static int event_hist_trigger_parse(struct event_comm= and *cmd_ops, trigger_data =3D trigger_data_alloc(cmd_ops, cmd, param, hist_data); if (!trigger_data) { ret =3D -ENOMEM; - goto out_free; + goto out_hist_data; } =20 ret =3D event_trigger_set_filter(cmd_ops, file, filter, trigger_data); @@ -6591,6 +6591,7 @@ static int event_hist_trigger_parse(struct event_comm= and *cmd_ops, event_trigger_unregister(cmd_ops, file, glob+1, trigger_data); out_free: event_trigger_reset_filter(cmd_ops, trigger_data); + out_hist_data: =20 remove_hist_vars(hist_data); =20 --=20 2.43.0