From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D60AE2EA468 for ; Mon, 13 Jul 2026 15:38:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=216.40.44.15 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783957102; cv=none; b=grNXiruHjOqJPXOaY4ncRhuaHNulpF6laKJLBazpKozHiMhMTf45LWtFv6A2St/Ef0Q1PDvXikUZONu7p1CkWLEMcXPm283Vmi/Igcqx4h6nvsaCENEdCV2n/6Ey4ft5xSNB5CpusGo/y//1IavxEGImC8r3A2ynzEGndSXqLBs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783957102; c=relaxed/simple; bh=vt/PexXV50gTKl/xQrTT4HhzS4uYKU4knJ+plkx+Slg=; h=Date:From:To:Cc:Subject:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=cA9OJCWajcy8aDiM6Q94tnPd5cqUCm94a05ppBmPgNFcczK0AKnZ4YCxAhJ5UaVea7sMo0Vmb8Md89TcU/JGtByDAWH/t4hQKmZNGuKxXWWbuTvBqOHfacEqR7WEBe8hwnOxptLUjOgn41UHiguAfWZrqWWrhjyBuFiN+oIbAHY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=goodmis.org; spf=pass smtp.mailfrom=goodmis.org; arc=none smtp.client-ip=216.40.44.15 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=goodmis.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=goodmis.org Received: from omf05.hostedemail.com (lb01a-stub [10.200.18.249]) by unirelay09.hostedemail.com (Postfix) with ESMTP id EB4BA8AFF8; Mon, 13 Jul 2026 15:38:13 +0000 (UTC) Received: from [HIDDEN] (Authenticated sender: rostedt@goodmis.org) by omf05.hostedemail.com (Postfix) with ESMTPA id 43AAA20016; Mon, 13 Jul 2026 15:38:12 +0000 (UTC) Date: Mon, 13 Jul 2026 11:38:11 -0400 From: Steven Rostedt To: Alexander Konyukhov Cc: , , Subject: Re: [PATCH] fix NULL dereference in event_trigger_reset_filter() Message-ID: <20260713113811.19191c03@robin> In-Reply-To: <20260713145054.2731267-1-Alexander.Konyukhov@kaspersky.com> References: <20260713145054.2731267-1-Alexander.Konyukhov@kaspersky.com> X-Mailer: Claws Mail 4.4.0 (GTK 3.24.52; x86_64-redhat-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Stat-Signature: 1g853ou9spqwar4wk7s8pju6trmuncc4 X-Rspamd-Server: rspamout04 X-Rspamd-Queue-Id: 43AAA20016 X-Session-Marker: 726F737465647440676F6F646D69732E6F7267 X-Session-ID: U2FsdGVkX1+psWUjsQv7z0AEAwNSwLB/fd7lpaKdQhw= X-HE-Tag: 1783957092-713115 X-HE-Meta: U2FsdGVkX1+dsD8tDLem3DzJocU6RrnMsZG/wg6bpF5CFd8t1VKni3LgfPzOar62ZJxdTLvapbp4VHGba+ZQzOnANgkrSAZPeAW7l1M36rp37XZh1QcH5y4fTtKmZKyuedS+g3cHUJ4D7JBvdaNQPRWJOAU96Ayw5kyqL8SHL89Odk/VOLnvPoIpx4cxkK1gI0M8S5cZjZQcJnxmQ3Evr0e5m81Rd9Vvh2rsvRxLreD01hN2sxsdHevOLpgyZzgh8tZAQRAsO9Y0slvbHimbE0ufOLq/mAqS3cGlnzqj6dZewSIWL6jvR7a1bN/vPHH6aPKUvPZRAlhv2SDrIJdyv2Io0eZczW/oIWAFlBAKSHjFst7R2kLk42hCVhvYd0dWrIx460DaJoUzxFY3shDRHA== On Mon, 13 Jul 2026 17:50:54 +0300 Alexander Konyukhov wrote: > Fixes a null pointer dereference in the trace events subsystem. > When trigger_data_alloc() returns NULL, the original code jumps to out_free, > invoking event_trigger_reset_filter() with a NULL pointer. > This propagates through set_trigger_filter() and dereferences data->filter_str > with data == NULL in trace_events_trigger.c. > > The patch adds out_hist_data, rerouting allocation failures to skip > event_trigger_reset_filter() on NULL and clean up via remove_hist_vars(hist_data). > > Found by Linux Verification Center (linuxtesting.org) with SVACE. What kernel are you using? > > Fixes: 4b147936fa50 ("tracing: Add support for 'synthetic' events") > Signed-off-by: Alexander Konyukhov > --- > kernel/trace/trace_events_hist.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c > index 336fc54d8ec8..9d203ab56fac 100644 > --- a/kernel/trace/trace_events_hist.c > +++ b/kernel/trace/trace_events_hist.c > @@ -6525,7 +6525,7 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops, > trigger_data = trigger_data_alloc(cmd_ops, cmd, param, hist_data); > if (!trigger_data) { > ret = -ENOMEM; > - goto out_free; > + goto out_hist_data; > } > > ret = event_trigger_set_filter(cmd_ops, file, filter, trigger_data); > @@ -6591,6 +6591,7 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops, > event_trigger_unregister(cmd_ops, file, glob+1, trigger_data); > out_free: > event_trigger_reset_filter(cmd_ops, trigger_data); The above has been removed by commit a4e0ea0e10a2 ("tracing: Remove redundant call to event_trigger_reset_filter() in event_hist_trigger_parse()") -- Steve > + out_hist_data: > > remove_hist_vars(hist_data); >