CVE-2025-21899: tracing: Fix bad hist from corrupting named_triggers list

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix bad hist from corrupting namedtriggers list

The following commands causes a crash:

~# cd /sys/kernel/tracing/events/rcu/rcucallback ~# echo 'hist:name=bad:keys=commonpid:onmax(bogus).save(commonpid)' > trigger bash: echo: write error: Invalid argument ~# echo 'hist:name=bad:keys=commonpid' > trigger

Because the following occurs:

eventtriggerwrite() { triggerprocessregex() { eventhisttriggerparse() {

data = eventtriggeralloc(..);

eventtriggerregister(.., data) { cmdops->reg(.., data, ..) [histregistertrigger()] { data->ops->init() [eventhisttriggerinit()] { savenamedtrigger(name, data) { listadd(&data->namedlist, &namedtriggers); } } } }

ret = createactions(); (return -EINVAL) if (ret) goto outunreg; [..] ret = histtriggerenable(data, ...) { listaddtailrcu(&data->list, &file->triggers); <<<---- SKIPPED!!! (this is important!) [..] outunreg: eventhistunregister(.., data) { cmdops->unreg(.., data, ..) [histunregistertrigger()] { listforeachentry(iter, &file->triggers, list) { if (!histtriggermatch(data, iter, nameddata, false)) <- never matches continue; [..] test = iter; } if (test && test->ops->free) <<<-- test is NULL

test->ops->free(test) [eventhisttriggerfree()] { [..] if (data->name) delnamedtrigger(data) { listdel(&data->namedlist); <<<<-- NEVER gets removed! } } } }

[..] kfree(data); <<<-- frees item but it is still on list

The next time a hist with name is registered, it causes an u-a-f bug and the kernel can crash.

Move the code around such that if eventtriggerregister() succeeds, the next thing called is histtriggerenable() which adds it to the list.

A bunch of actions is called if getnamedtriggerdata() returns false. But that doesn't need to be called after eventtriggerregister(), so it can be moved up, allowing eventtriggerregister() to be called just before histtriggerenable() keeping them together and allowing the file->triggers to be properly populated.