# \[PATCH v4 05/15\] tracing/filters: Check for missing operand after operator in parse\_pred() - From: Masami Hiramatsu (Google) \ - Date: 2026-10-29 01:38:15 - List: linux-trace-kernel - Page: https://ratatoskr.run/linux-trace-kernel/2026/10/17824026 - Thread: https://ratatoskr.run/linux-trace-kernel/2026/10/17824014/t.md ```text From: Masami Hiramatsu (Google) In parse_pred(), after matching the operator and skipping whitespace, the filter string may terminate (str[i] == '\0') if the operand is missing (e.g. "ip ==" or "common_pid =="). For function events, the loop 'for (i++; str[i]; i++)' unconditionally increments 'i' past the NUL terminator, causing an out-of-bounds read. For other event types, allocating a predicate only to fail later during value parsing is wasteful. Check if 'str[i]' is NUL immediately after skipping whitespace after the operator, and report FILT_ERR_INVALID_FILTER. Fixes: 80765597bc58 ("tracing: Rewrite filter logic to be simpler and faster") Cc: Signed-off-by: Masami Hiramatsu (Google) --- Changes in v3: - Split from the monolithic function event parsing patch. - Check if str[i] is NUL immediately after skipping whitespace after the operator in parse_pred() across all event types, as suggested by Steven Rostedt. --- kernel/trace/trace_events_filter.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c index b8d765ca9f1a..a7a89e0f9b87 100644 --- a/kernel/trace/trace_events_filter.c +++ b/kernel/trace/trace_events_filter.c @@ -1762,6 +1762,11 @@ static int parse_pred(const char *str, void *data, while (isspace(str[i])) i++; + if (!str[i]) { + parse_error(pe, FILT_ERR_INVALID_FILTER, pos + i); + goto err_free; + } + s = i; pred = kzalloc_obj(*pred); ```