Re: [PATCH v4 02/15] tracing/filters: Fix false success return in process_system_preds()

On Thu, 29 Oct 2026 01:45:53 +0000, sashiko-bot@kernel.org [off-list ref] wrote:

[Severity: Medium]
Can process_system_preds() return 0 instead of -ENOMEM when an allocation
fails after at least one event matches the filter?

In kernel/trace/trace_events_filter.c:process_system_preds(), ret is
initialized to -ENOMEM and cleared to 0 as soon as process_preds() succeeds
for an event:

	err = process_preds(file->event_call, filter_string, filter, pe);
	if (err) {
		...
	} else {
		event_set_filtered_flag(file);
		ret = 0;
	}

	filter_item = kzalloc_obj(*filter_item);
	if (!filter_item)
		goto fail_mem;

If kzalloc_obj(*filter_item) fails on that same iteration, or if
kzalloc_obj(*filter), kstrdup(), or kzalloc_obj(*filter_item) fails on a
subsequent event in the loop, jumping to fail_mem returns ret (which is now
0) instead of -ENOMEM.

That causes create_system_filter() and apply_subsystem_event_filter() to
treat the aborted update as a success, leaving the remaining events in the
subsystem without the new filter applied. Also, if kzalloc_obj(*filter_item)
fails right after event_set_filtered_flag(file) runs, EVENT_FILE_FL_FILTERED
is set and trace_buffered_event_enable() is called, while fail_mem frees the
new filter without installing it via event_set_filter(file, filter).

Oops, right. Hmm, it is better to set ENOMEM for each goto fail_mem...

Thanks,

-- 
Masami Hiramatsu (Google) [off-list ref]