# Re: \[PATCH v4 02/15\] tracing/filters: Fix false success return in process\_system\_preds()

- From: Masami Hiramatsu (Google) \<mhiramat@kernel.org\>
- Date: 2026-10-29 01:58:30 
- List: linux-trace-kernel
- Page: https://ratatoskr.run/linux-trace-kernel/2026/10/17824086
- Thread: https://ratatoskr.run/linux-trace-kernel/2026/10/17824014/t.md

```text
On Thu, 29 Oct 2026 01:45:53 +0000, sashiko-bot@kernel.org [ref] wrote:
> [Severity: Medium]
> Can process_system_preds() return 0 instead of -ENOMEM when an allocation
> fails after at least one event matches the filter?
> 
> In kernel/trace/trace_events_filter.c:process_system_preds(), ret is
> initialized to -ENOMEM and cleared to 0 as soon as process_preds() succeeds
> for an event:
> 
> 	err = process_preds(file->event_call, filter_string, filter, pe);
> 	if (err) {
> 		...
> 	} else {
> 		event_set_filtered_flag(file);
> 		ret = 0;
> 	}
> 
> 	filter_item = kzalloc_obj(*filter_item);
> 	if (!filter_item)
> 		goto fail_mem;
> 
> If kzalloc_obj(*filter_item) fails on that same iteration, or if
> kzalloc_obj(*filter), kstrdup(), or kzalloc_obj(*filter_item) fails on a
> subsequent event in the loop, jumping to fail_mem returns ret (which is now
> 0) instead of -ENOMEM.
> 
> That causes create_system_filter() and apply_subsystem_event_filter() to
> treat the aborted update as a success, leaving the remaining events in the
> subsystem without the new filter applied. Also, if kzalloc_obj(*filter_item)
> fails right after event_set_filtered_flag(file) runs, EVENT_FILE_FL_FILTERED
> is set and trace_buffered_event_enable() is called, while fail_mem frees the
> new filter without installing it via event_set_filter(file, filter).

Oops, right. Hmm, it is better to set ENOMEM for each goto fail_mem...

Thanks,

-- 
Masami Hiramatsu (Google) [ref]
```