CVE-2025-21899

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix bad hist from corrupting named_triggers list

The following commands causes a crash:

~# cd /sys/kernel/tracing/events/rcu/rcu_callback

~# echo 'hist:name=bad:keys=common_pid:onmax(bogus).save(common_pid)' > trigger

bash: echo: write error: Invalid argument

~# echo 'hist:name=bad:keys=common_pid' > trigger

Because the following occurs:

event_trigger_write() {

trigger_process_regex() {

event_hist_trigger_parse() {

data = event_trigger_alloc(..);

event_trigger_register(.., data) {

cmd_ops->reg(.., data, ..) [hist_register_trigger()] {

data->ops->init() [event_hist_trigger_init()] {

save_named_trigger(name, data) {

list_add(&data->named_list, &named_triggers);

}

}

}

}

ret = create_actions(); (return -EINVAL)

if (ret)

goto out_unreg;

[..]

ret = hist_trigger_enable(data, ...) {

list_add_tail_rcu(&data->list, &file->triggers); <<<---- SKIPPED!!! (this is important!)

[..]

out_unreg:

event_hist_unregister(.., data) {

cmd_ops->unreg(.., data, ..) [hist_unregister_trigger()] {

list_for_each_entry(iter, &file->triggers, list) {

if (!hist_trigger_match(data, iter, named_data, false)) <- never matches

continue;

[..]

test = iter;

}

if (test && test->ops->free) <<<-- test is NULL

test->ops->free(test) [event_hist_trigger_free()] {

[..]

if (data->name)

del_named_trigger(data) {

list_del(&data->named_list); <<<<-- NEVER gets removed!

}

}

}

}

[..]

kfree(data); <<<-- frees item but it is still on list

The next time a hist with name is registered, it causes an u-a-f bug and

the kernel can crash.

Move the code around such that if event_trigger_register() succeeds, the

next thing called is hist_trigger_enable() which adds it to the list.

A bunch of actions is called if get_named_trigger_data() returns false.

But that doesn't need to be called after event_trigger_register(), so it

can be moved up, allowing event_trigger_register() to be called just

before hist_trigger_enable() keeping them together and allowing the

file->triggers to be properly populated.