Commit c47a7b11bcb3 for kernel

commit c47a7b11bcb3d45e29723afcf6336866476b1d08
Author: Taeyang Lee <0wn@theori.io>
Date:   Fri Oct 16 02:19:55 2026 +0900

    tracing: Check operator stack capacity before pushing

    predicate_parse() uses the first operator stack entry before processing
    any opening parentheses. A push then increments top before writing.
    The existing check still permits that write when top already points to
    the last allocated entry, which can access beyond the operator stack.

    Reject the push when top reaches the last allocated entry.

    Cc: stable@vger.kernel.org
    Fixes: 39f7c41c908b ("tracing/filters: Enable filtering a cpumask field by another cpumask")
    Link: https://patch.msgid.link/atELO9L0I9kg5CpC@Taeyangs-MacBook-Pro.local
    Signed-off-by: Taeyang Lee <0wn@theori.io>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index 781416ba6bdf..127880ebe83f 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -511,7 +511,7 @@ predicate_parse(const char *str, int nr_parens, int nr_preds,

 		switch (*next) {
 		case '(':					/* #2 */
-			if (top - op_stack > nr_parens) {
+			if (top - op_stack >= nr_parens - 1) {
 				ret = -EINVAL;
 				goto out_free;
 			}