[lvc-project] [PATCH] fix NULL dereference in event_trigger_reset_filter()

[Alexander Konyukhov]

Fixes a null pointer dereference in the trace events subsystem. 
When trigger_data_alloc() returns NULL, the original code jumps to out_free,
invoking event_trigger_reset_filter() with a NULL pointer. 
This propagates through set_trigger_filter() and dereferences data->filter_str 
with data == NULL in trace_events_trigger.c.

The patch adds out_hist_data, rerouting allocation failures to skip 
event_trigger_reset_filter() on NULL and clean up via remove_hist_vars(hist_data).

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 4b147936fa50 ("tracing: Add support for 'synthetic' events")
Signed-off-by: Alexander Konyukhov <Alexander.Konyukhov at kaspersky.com>
---
 kernel/trace/trace_events_hist.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index 336fc54d8ec8..9d203ab56fac 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -6525,7 +6525,7 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops,
 	trigger_data = trigger_data_alloc(cmd_ops, cmd, param, hist_data);
 	if (!trigger_data) {
 		ret = -ENOMEM;
-		goto out_free;
+		goto out_hist_data;
 	}
 
 	ret = event_trigger_set_filter(cmd_ops, file, filter, trigger_data);
@@ -6591,6 +6591,7 @@ static int event_hist_trigger_parse(struct event_command *cmd_ops,
 	event_trigger_unregister(cmd_ops, file, glob+1, trigger_data);
  out_free:
 	event_trigger_reset_filter(cmd_ops, trigger_data);
+ out_hist_data:
 
 	remove_hist_vars(hist_data);
 
-- 
2.43.0