Re: [BUG] tracing: trigger filter use-after-free in set_trigger_filter() ENOMEM path

[Steven Rostedt]

On Sat, 24 Oct 2026 22:48:16 +0800
Guikun Yang <yangguiku...@qq.com> wrote:

> Fix: either free the new filter before publishing (i.e., don't
> rcu_assign_pointer until the filter_str copy succeeded), or perform
> tracepoint_synchronize_unregister() before free_event_filter() in the
> ENOMEM path, mirroring the normal path.  The first variant is
> cheaper: move the kstrdup above the "assign:" label and release the
> pointer only after the string copy succeeded.

Note, the entire trigger code needs a rewrite. Something I'm looking at
doing when I get time.

This is a bug but one that would be very hard to hit as it would
require and admin to enable a trigger with a filter during major memory
pressure.

That said, the simplest fix is to simply copy the filter_str at near
the start and use that.

That is, something like this (not even compiled tested):

diff --git a/kernel/trace/trace_events_trigger.c 
b/kernel/trace/trace_events_trigger.c
index 4d2fde996c0f..1a6ea4261066 100644
--- a/kernel/trace/trace_events_trigger.c
+++ b/kernel/trace/trace_events_trigger.c
@@ -1195,6 +1195,7 @@ int set_trigger_filter(char *filter_str,
 {
        struct event_trigger_data *data = trigger_data;
        struct event_filter *filter = NULL, *tmp;
+       char *str __free(kfree) = NULL;
        int ret = -EINVAL;
        char *s;
 
@@ -1209,9 +1210,13 @@ int set_trigger_filter(char *filter_str,
        if (!filter_str)
                return ret;
 
+       str = kstrdup(filter_str, GFP_KERNEL);
+       if (!str)
+               return -ENOMEM;
+
        /* The filter is for the 'trigger' event, not the triggered event */
        ret = create_event_filter(file->tr, file->event_call,
-                                 filter_str, true, &filter);
+                                 str, true, &filter);
 
        /* Only enabled set_str for error handling */
        if (filter) {
@@ -1243,14 +1248,9 @@ int set_trigger_filter(char *filter_str,
        kfree(data->filter_str);
        data->filter_str = NULL;
 
-       if (filter_str) {
-               data->filter_str = kstrdup(filter_str, GFP_KERNEL);
-               if (!data->filter_str) {
-                       free_event_filter(rcu_access_pointer(data->filter));
-                       data->filter = NULL;
-                       ret = -ENOMEM;
-               }
-       }
+       if (str)
+               data->filter_str = no_free_ptr(str);
+
        return ret;
 }