Re: [PATCH] fix NULL dereference in event_trigger_reset_filter()

[Steven Rostedt]

On Mon, 13 Jul 2026 17:50:54 +0300
Alexander Konyukhov <Alexander.Konyukhov@xxxxxxxxxxxxx> wrote:

> Fixes a null pointer dereference in the trace events subsystem. 
> When trigger_data_alloc() returns NULL, the original code jumps to out_free,
> invoking event_trigger_reset_filter() with a NULL pointer. 
> This propagates through set_trigger_filter() and dereferences data->filter_str 
> with data == NULL in trace_events_trigger.c.
> 
> The patch adds out_hist_data, rerouting allocation failures to skip 
> event_trigger_reset_filter() on NULL and clean up via remove_hist_vars(hist_data).
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.

What kernel are you using?

> 
> Fixes: 4b147936fa50 ("tracing: Add support for 'synthetic' events")
> Signed-off-by: Alexander Konyukhov <Alexander.Konyukhov@xxxxxxxxxxxxx>
> ---
>  kernel/trace/trace_events_hist.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
> index 336fc54d8ec8..9d203ab56fac 100644
> --- a/kernel/trace/trace_events_hist.c
> +++ b/kernel/trace/trace_events_hist.c
> @@ -6525,7 +6525,7 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops,
>  	trigger_data = trigger_data_alloc(cmd_ops, cmd, param, hist_data);
>  	if (!trigger_data) {
>  		ret = -ENOMEM;
> -		goto out_free;
> +		goto out_hist_data;
>  	}
>  
>  	ret = event_trigger_set_filter(cmd_ops, file, filter, trigger_data);
> @@ -6591,6 +6591,7 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops,
>  	event_trigger_unregister(cmd_ops, file, glob+1, trigger_data);
>   out_free:
>  	event_trigger_reset_filter(cmd_ops, trigger_data);

The above has been removed by commit a4e0ea0e10a2 ("tracing: Remove
redundant call to event_trigger_reset_filter() in event_hist_trigger_parse()")

-- Steve


> + out_hist_data:
>  
>  	remove_hist_vars(hist_data);
>