Re: [BUG] tracing: trigger filter use-after-free in set_trigger_filter() ENOMEM path

[Steven Rostedt <rostedt@goodmis.org>]

On Sat, 24 Oct 2026 22:48:16 +0800
Guikun Yang <yangguikun19@qq.com> wrote:

> Fix: either free the new filter before publishing (i.e., don't
> rcu_assign_pointer until the filter_str copy succeeded), or perform
> tracepoint_synchronize_unregister() before free_event_filter() in the
> ENOMEM path, mirroring the normal path.  The first variant is
> cheaper: move the kstrdup above the "assign:" label and release the
> pointer only after the string copy succeeded.

Note, the entire trigger code needs a rewrite. Something I'm looking at
doing when I get time.

This is a bug but one that would be very hard to hit as it would
require and admin to enable a trigger with a filter during major memory
pressure.

That said, the simplest fix is to simply copy the filter_str at near
the start and use that.

That is, something like this (not even compiled tested):

diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
index 4d2fde996c0f..1a6ea4261066 100644
--- a/kernel/trace/trace_events_trigger.c
+++ b/kernel/trace/trace_events_trigger.c
@@ -1195,6 +1195,7 @@ int set_trigger_filter(char *filter_str,
 {
 	struct event_trigger_data *data = trigger_data;
 	struct event_filter *filter = NULL, *tmp;
+	char *str __free(kfree) = NULL;
 	int ret = -EINVAL;
 	char *s;
 
@@ -1209,9 +1210,13 @@ int set_trigger_filter(char *filter_str,
 	if (!filter_str)
 		return ret;
 
+	str = kstrdup(filter_str, GFP_KERNEL);
+	if (!str)
+		return -ENOMEM;
+
 	/* The filter is for the 'trigger' event, not the triggered event */
 	ret = create_event_filter(file->tr, file->event_call,
-				  filter_str, true, &filter);
+				  str, true, &filter);
 
 	/* Only enabled set_str for error handling */
 	if (filter) {
@@ -1243,14 +1248,9 @@ int set_trigger_filter(char *filter_str,
 	kfree(data->filter_str);
 	data->filter_str = NULL;
 
-	if (filter_str) {
-		data->filter_str = kstrdup(filter_str, GFP_KERNEL);
-		if (!data->filter_str) {
-			free_event_filter(rcu_access_pointer(data->filter));
-			data->filter = NULL;
-			ret = -ENOMEM;
-		}
-	}
+	if (str)
+		data->filter_str = no_free_ptr(str);
+
 	return ret;
 }