Merge tag 'trace-fix-filter-4.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace

Pull tracing filter fix from Steven Rostedt:
 "Vince Weaver reported a warning when he added perf event filters into
  his fuzzer tests.  There's a missing check of balanced operations when
  parenthesis are used, and this triggers a WARN_ON() and when reading
  the failure, the filter reports no failure occurred.

  The operands were not being checked if they match, this adds that"

* tag 'trace-fix-filter-4.1-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
  tracing: Have filter check for balanced ops

1 files changed, 9 insertions, 2 deletions

diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index ced69da0ff55..7f2e97ce71a7 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1369,19 +1369,26 @@ static int check_preds(struct filter_parse_state *ps)
 {
         int n_normal_preds = 0, n_logical_preds = 0;
         struct postfix_elt *elt;
+        int cnt = 0;
 
         list_for_each_entry(elt, &ps->postfix, list) {
-                if (elt->op == OP_NONE)
+                if (elt->op == OP_NONE) {
+                        cnt++;
                         continue;
+                }
 
                 if (elt->op == OP_AND || elt->op == OP_OR) {
                         n_logical_preds++;
+                        cnt--;
                         continue;
                 }
+                if (elt->op != OP_NOT)
+                        cnt--;
                 n_normal_preds++;
+                WARN_ON_ONCE(cnt < 0);
         }
 
-        if (!n_normal_preds || n_logical_preds >= n_normal_preds) {
+        if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
                 parse_error(ps, FILT_ERR_INVALID_FILTER, 0);
                 return -EINVAL;
         }