# \[PATCH v4 07/15\] tracing/filters: Reject empty unquoted operand in function event filter - From: Masami Hiramatsu (Google) \ - Date: 2026-10-29 01:38:34 - List: linux-trace-kernel - Page: https://ratatoskr.run/linux-trace-kernel/2026/10/17824027 - Thread: https://ratatoskr.run/linux-trace-kernel/2026/10/17824014/t.md ```text From: Masami Hiramatsu (Google) In parse_pred(), when parsing an unquoted operand for function events, if the filter expression has no operand before a delimiter (e.g. '(ip == )' or '(ip == && x == 1)'), the loop terminates with len == 0. While an empty quoted string (e.g. 'ip == ""') is syntactically valid and denotes an empty pattern, an unquoted empty operand is a syntax error where an operand was expected before the delimiter. Previously, this accepted the predicate with an empty pattern. Reject empty unquoted operands by checking '!q && !len' and reporting FILT_ERR_INVALID_VALUE. Fixes: 80765597bc58 ("tracing: Rewrite filter logic to be simpler and faster") Cc: Signed-off-by: Masami Hiramatsu (Google) --- Changes in v3: - Split from the monolithic function event parsing patch into a standalone patch rejecting empty unquoted operands (!q && !len). --- kernel/trace/trace_events_filter.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c index 05579895c810..a645af9eb1f8 100644 --- a/kernel/trace/trace_events_filter.c +++ b/kernel/trace/trace_events_filter.c @@ -1880,6 +1880,10 @@ static int parse_pred(const char *str, void *data, len = i - s; if (q) i++; + if (!q && !len) { + parse_error(pe, FILT_ERR_INVALID_VALUE, pos + i); + goto err_free; + } if (len >= MAX_FILTER_STR_VAL) { parse_error(pe, FILT_ERR_OPERAND_TOO_LONG, pos + i); goto err_free; ```