* [PATCH v2 01/16] perf script: Fix metric_evlist leak in script_find_metrics
2026-06-24 5:15 ` [PATCH v2 00/16] perf python: Fix python extension bugs from v19 review Ian Rogers
@ 2026-06-24 5:15 ` Ian Rogers
2026-06-24 5:15 ` [PATCH v2 02/16] perf stat: Fix evsel_list leak in cmd_stat Ian Rogers
` (17 subsequent siblings)
18 siblings, 0 replies; 74+ messages in thread
From: Ian Rogers @ 2026-06-24 5:15 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
Fix a memory leak in script_find_metrics() where metric_evlist is leaked
when returning early on error paths.
Assisted-by: Antigravity:gemini-3.1-pro
Fixes: 3622990efaab ("perf script: Change metric format to use json metrics")
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/builtin-script.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
index 47afd8cdc2b7..6b69e982ba62 100644
--- a/tools/perf/builtin-script.c
+++ b/tools/perf/builtin-script.c
@@ -2275,8 +2275,8 @@ static int script_find_metrics(const struct pmu_metric *pm,
}
pr_debug("Found metric '%s' whose evsels match those of in the perf data\n",
pm->metric_name);
- evlist__put(metric_evlist);
out:
+ evlist__put(metric_evlist);
return 0;
}
--
2.55.0.rc0.799.gd6f94ed593-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* [PATCH v2 02/16] perf stat: Fix evsel_list leak in cmd_stat
2026-06-24 5:15 ` [PATCH v2 00/16] perf python: Fix python extension bugs from v19 review Ian Rogers
2026-06-24 5:15 ` [PATCH v2 01/16] perf script: Fix metric_evlist leak in script_find_metrics Ian Rogers
@ 2026-06-24 5:15 ` Ian Rogers
2026-06-24 5:15 ` [PATCH v2 03/16] perf tools: Fix sb_evlist leaks in top and record Ian Rogers
` (16 subsequent siblings)
18 siblings, 0 replies; 74+ messages in thread
From: Ian Rogers @ 2026-06-24 5:15 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
Fix a memory leak in cmd_stat() where evsel_list is leaked if an error
occurs while opening the output file.
Assisted-by: Antigravity:gemini-3.1-pro
Fixes: 361c99a661a7 ("perf evsel: Introduce perf_evlist")
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/builtin-stat.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index 3f897b2e8638..7cb6ea937e87 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -2718,7 +2718,8 @@ int cmd_stat(int argc, const char **argv)
output = fopen(output_name, mode);
if (!output) {
perror("failed to create output file");
- return -1;
+ status = -1;
+ goto out;
}
if (!stat_config.json_output) {
clock_gettime(CLOCK_REALTIME, &tm);
@@ -2729,7 +2730,8 @@ int cmd_stat(int argc, const char **argv)
output = fdopen(output_fd, mode);
if (!output) {
perror("Failed opening logfd");
- return -errno;
+ status = -errno;
+ goto out;
}
}
@@ -2738,7 +2740,8 @@ int cmd_stat(int argc, const char **argv)
parse_options_usage(stat_usage, stat_options, "o", 1);
parse_options_usage(NULL, stat_options, "log-fd", 0);
parse_options_usage(NULL, stat_options, "interval-clear", 0);
- return -1;
+ status = -1;
+ goto out;
}
stat_config.output = output;
--
2.55.0.rc0.799.gd6f94ed593-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* [PATCH v2 03/16] perf tools: Fix sb_evlist leaks in top and record
2026-06-24 5:15 ` [PATCH v2 00/16] perf python: Fix python extension bugs from v19 review Ian Rogers
2026-06-24 5:15 ` [PATCH v2 01/16] perf script: Fix metric_evlist leak in script_find_metrics Ian Rogers
2026-06-24 5:15 ` [PATCH v2 02/16] perf stat: Fix evsel_list leak in cmd_stat Ian Rogers
@ 2026-06-24 5:15 ` Ian Rogers
2026-06-24 5:15 ` [PATCH v2 03/16] perf top: Fix sb_evlist leak Ian Rogers
` (15 subsequent siblings)
18 siblings, 0 replies; 74+ messages in thread
From: Ian Rogers @ 2026-06-24 5:15 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
Fix a memory leak in cmd_top() where top.sb_evlist was not freed if
evlist__add_bpf_sb_event() fails. Note that evlist__start_sb_thread() and
evlist__stop_sb_thread() take ownership of the evlist and free it, so
we must only free it if we fail before starting the thread. Also set
top.sb_evlist to NULL to prevent use-after-free bugs.
Apply the same fix to builtin-record.c to avoid leaking rec->sb_evlist
and calling pthread_join on uninitialized threads in the error path.
Assisted-by: Antigravity:gemini-3.1-pro
Fixes: b38d85ef49cf ("perf bpf: Decouple creating the evlist from adding the SB event")
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/builtin-record.c | 2 ++
tools/perf/builtin-top.c | 2 ++
2 files changed, 4 insertions(+)
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index ebd3ed0c9b3e..b106d50f6d97 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -2247,6 +2247,8 @@ static int record__setup_sb_evlist(struct record *rec)
if (evlist__add_bpf_sb_event(rec->sb_evlist, perf_session__env(rec->session))) {
pr_err("Couldn't ask for PERF_RECORD_BPF_EVENT side band events.\n.");
+ evlist__put(rec->sb_evlist);
+ rec->sb_evlist = NULL;
return -1;
}
}
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index 5933c46ee137..570410599f1b 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -1881,6 +1881,8 @@ int cmd_top(int argc, const char **argv)
if (evlist__add_bpf_sb_event(top.sb_evlist, &host_env)) {
pr_err("Couldn't ask for PERF_RECORD_BPF_EVENT side band events.\n.");
status = -EINVAL;
+ evlist__put(top.sb_evlist);
+ top.sb_evlist = NULL;
goto out_put_evlist;
}
}
--
2.55.0.rc0.799.gd6f94ed593-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* [PATCH v2 03/16] perf top: Fix sb_evlist leak
2026-06-24 5:15 ` [PATCH v2 00/16] perf python: Fix python extension bugs from v19 review Ian Rogers
` (2 preceding siblings ...)
2026-06-24 5:15 ` [PATCH v2 03/16] perf tools: Fix sb_evlist leaks in top and record Ian Rogers
@ 2026-06-24 5:15 ` Ian Rogers
2026-07-04 16:55 ` Namhyung Kim
2026-06-24 5:15 ` [PATCH v2 04/16] perf python: Fix memory leak in pyrf_evlist__get_pollfd Ian Rogers
` (14 subsequent siblings)
18 siblings, 1 reply; 74+ messages in thread
From: Ian Rogers @ 2026-06-24 5:15 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
Fix a memory leak in cmd_top() where top.sb_evlist was not freed if
evlist__add_bpf_sb_event() fails. Note that evlist__start_sb_thread() and
evlist__stop_sb_thread() take ownership of the evlist and free it, so
we must only free it if we fail before starting the thread.
Assisted-by: Antigravity:gemini-3.1-pro
Fixes: b38d85ef49cf ("perf bpf: Decouple creating the evlist from adding the SB event")
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/builtin-top.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index 5933c46ee137..abc74b8ab759 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -1881,6 +1881,7 @@ int cmd_top(int argc, const char **argv)
if (evlist__add_bpf_sb_event(top.sb_evlist, &host_env)) {
pr_err("Couldn't ask for PERF_RECORD_BPF_EVENT side band events.\n.");
status = -EINVAL;
+ evlist__put(top.sb_evlist);
goto out_put_evlist;
}
}
--
2.55.0.rc0.799.gd6f94ed593-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* Re: [PATCH v2 03/16] perf top: Fix sb_evlist leak
2026-06-24 5:15 ` [PATCH v2 03/16] perf top: Fix sb_evlist leak Ian Rogers
@ 2026-07-04 16:55 ` Namhyung Kim
0 siblings, 0 replies; 74+ messages in thread
From: Namhyung Kim @ 2026-07-04 16:55 UTC (permalink / raw)
To: Ian Rogers
Cc: acme, adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark,
leo.yan, linux-kernel, linux-perf-users, mingo, peterz, tmricht
On Tue, Jun 23, 2026 at 10:15:21PM -0700, Ian Rogers wrote:
> Fix a memory leak in cmd_top() where top.sb_evlist was not freed if
> evlist__add_bpf_sb_event() fails. Note that evlist__start_sb_thread() and
> evlist__stop_sb_thread() take ownership of the evlist and free it, so
> we must only free it if we fail before starting the thread.
>
> Assisted-by: Antigravity:gemini-3.1-pro
> Fixes: b38d85ef49cf ("perf bpf: Decouple creating the evlist from adding the SB event")
> Signed-off-by: Ian Rogers <irogers@google.com>
Looks like a leftover from v1. There are two 03/16 patches. :)
Thanks,
Namhyung
^ permalink raw reply [flat|nested] 74+ messages in thread
* [PATCH v2 04/16] perf python: Fix memory leak in pyrf_evlist__get_pollfd
2026-06-24 5:15 ` [PATCH v2 00/16] perf python: Fix python extension bugs from v19 review Ian Rogers
` (3 preceding siblings ...)
2026-06-24 5:15 ` [PATCH v2 03/16] perf top: Fix sb_evlist leak Ian Rogers
@ 2026-06-24 5:15 ` Ian Rogers
2026-06-24 5:28 ` sashiko-bot
2026-06-24 5:15 ` [PATCH v2 05/16] perf synthetic-events: Fix uninitialized pthread_join Ian Rogers
` (13 subsequent siblings)
18 siblings, 1 reply; 74+ messages in thread
From: Ian Rogers @ 2026-06-24 5:15 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
Fix a Python list object leak in pyrf_evlist__get_pollfd() by adding
a missing Py_DECREF on the error exit path.
Assisted-by: Antigravity:gemini-3.1-pro
Fixes: 877108e42b1b ("perf tools: Initial python binding")
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/util/python.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index 11e1f39c1bea..550f1e7d1449 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -2825,6 +2825,8 @@ static PyObject *pyrf_evlist__get_pollfd(struct pyrf_evlist *pevlist,
evlist = pevlist->evlist;
list = PyList_New(0);
+ if (!list)
+ return NULL;
for (i = 0; i < evlist__core(evlist)->pollfd.nr; ++i) {
PyObject *file;
@@ -2843,6 +2845,7 @@ static PyObject *pyrf_evlist__get_pollfd(struct pyrf_evlist *pevlist,
return list;
free_list:
+ Py_XDECREF(list);
return PyErr_NoMemory();
}
--
2.55.0.rc0.799.gd6f94ed593-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* Re: [PATCH v2 04/16] perf python: Fix memory leak in pyrf_evlist__get_pollfd
2026-06-24 5:15 ` [PATCH v2 04/16] perf python: Fix memory leak in pyrf_evlist__get_pollfd Ian Rogers
@ 2026-06-24 5:28 ` sashiko-bot
0 siblings, 0 replies; 74+ messages in thread
From: sashiko-bot @ 2026-06-24 5:28 UTC (permalink / raw)
To: Ian Rogers; +Cc: linux-perf-users
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [Low] Missing explicit POSIX libc header inclusions for `<stdlib.h>` and `<stdio.h>`.
--
commit b37f20df0f07ef7454731749a918a55a91b0c7db
Author: Ian Rogers <irogers@google.com>
perf python: Fix memory leak in pyrf_evlist__get_pollfd
This commit fixes a Python list object leak in pyrf_evlist__get_pollfd() by
adding a missing Py_DECREF on the error exit path.
> diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
> index 11e1f39c1bea9..550f1e7d14499 100644
> --- a/tools/perf/util/python.c
> +++ b/tools/perf/util/python.c
[Severity: Low]
This isn't a bug introduced by this patch, but there is a pre-existing issue
where the top-level includes section is missing explicit POSIX libc headers:
#include <inttypes.h>
#include <string.h>
#include <linux/err.h>
The file relies on POSIX standard functions like calloc() and free() which
require <stdlib.h>, as well as asprintf() which requires <stdio.h>. Could
these be explicitly added to ensure musl compilation compatibility?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260624051535.3584977-1-irogers@google.com?part=4
^ permalink raw reply [flat|nested] 74+ messages in thread
* [PATCH v2 05/16] perf synthetic-events: Fix uninitialized pthread_join
2026-06-24 5:15 ` [PATCH v2 00/16] perf python: Fix python extension bugs from v19 review Ian Rogers
` (4 preceding siblings ...)
2026-06-24 5:15 ` [PATCH v2 04/16] perf python: Fix memory leak in pyrf_evlist__get_pollfd Ian Rogers
@ 2026-06-24 5:15 ` Ian Rogers
2026-06-24 5:27 ` sashiko-bot
2026-06-24 5:15 ` [PATCH v2 06/16] perf data: Fix directory file descriptor leak in perf_data__switch Ian Rogers
` (12 subsequent siblings)
18 siblings, 1 reply; 74+ messages in thread
From: Ian Rogers @ 2026-06-24 5:15 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
In perf_event__synthesize_threads(), fix an uninitialized pthread_join()
call when thread creation fails by only joining the successfully
created threads.
Assisted-by: Antigravity:gemini-3.1-pro
Fixes: 340b47f510bb ("perf top: Implement multithreading for perf_event__synthesize_threads")
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/util/synthetic-events.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic-events.c
index b75f9dcf4dbf..35de41ad14d3 100644
--- a/tools/perf/util/synthetic-events.c
+++ b/tools/perf/util/synthetic-events.c
@@ -1104,8 +1104,8 @@ int perf_event__synthesize_threads(const struct perf_tool *tool,
}
err = 0;
out_join:
- for (i = 0; i < thread_nr; i++)
- pthread_join(synthesize_threads[i], NULL);
+ for (j = 0; j < i; j++)
+ pthread_join(synthesize_threads[j], NULL);
free(args);
free_threads:
free(synthesize_threads);
--
2.55.0.rc0.799.gd6f94ed593-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* Re: [PATCH v2 05/16] perf synthetic-events: Fix uninitialized pthread_join
2026-06-24 5:15 ` [PATCH v2 05/16] perf synthetic-events: Fix uninitialized pthread_join Ian Rogers
@ 2026-06-24 5:27 ` sashiko-bot
0 siblings, 0 replies; 74+ messages in thread
From: sashiko-bot @ 2026-06-24 5:27 UTC (permalink / raw)
To: Ian Rogers; +Cc: linux-perf-users
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [Low] Missing explicit POSIX inclusions for <stdlib.h> and <pthread.h> in synthetic-events.c.
--
commit 9ead28d76c34623188955779076a3c283fe73884
Author: Ian Rogers <irogers@google.com>
perf synthetic-events: Fix uninitialized pthread_join
This commit fixes an uninitialized pthread_join() call in
perf_event__synthesize_threads() when thread creation fails. It updates the
cleanup loop to only join the threads that were successfully created.
> diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic-events.c
> --- a/tools/perf/util/synthetic-events.c
> +++ b/tools/perf/util/synthetic-events.c
> @@ -1104,8 +1104,8 @@ int perf_event__synthesize_threads(const struct perf_tool *tool,
> }
> err = 0;
> out_join:
> - for (i = 0; i < thread_nr; i++)
> - pthread_join(synthesize_threads[i], NULL);
> + for (j = 0; j < i; j++)
> + pthread_join(synthesize_threads[j], NULL);
[Severity: Low]
This is a pre-existing issue, but should this file have explicit POSIX header
inclusions for <stdlib.h> and <pthread.h> to ensure compatibility with musl
libc? The code here relies on pthread_join() and free(), but appears to
depend on implicit header inclusions to resolve them.
> free(args);
> free_threads:
> free(synthesize_threads);
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260624051535.3584977-1-irogers@google.com?part=5
^ permalink raw reply [flat|nested] 74+ messages in thread
* [PATCH v2 06/16] perf data: Fix directory file descriptor leak in perf_data__switch
2026-06-24 5:15 ` [PATCH v2 00/16] perf python: Fix python extension bugs from v19 review Ian Rogers
` (5 preceding siblings ...)
2026-06-24 5:15 ` [PATCH v2 05/16] perf synthetic-events: Fix uninitialized pthread_join Ian Rogers
@ 2026-06-24 5:15 ` Ian Rogers
2026-06-24 5:30 ` sashiko-bot
2026-06-24 5:15 ` [PATCH v2 07/16] perf test: Fix skiplist leak in cmd_test Ian Rogers
` (11 subsequent siblings)
18 siblings, 1 reply; 74+ messages in thread
From: Ian Rogers @ 2026-06-24 5:15 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
Fix a file descriptor leak in perf_data__switch() when running in
directory mode. By substituting perf_data__close() for
perf_data_file__close(), any thread-local directory files are properly
closed during file rotation.
Assisted-by: Antigravity:gemini-3.1-pro
Fixes: 040f9915e99e ("perf data: Add perf_data_file__switch() helper")
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/util/data.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/tools/perf/util/data.c b/tools/perf/util/data.c
index 33fd1b82019e..32d4d908ad38 100644
--- a/tools/perf/util/data.c
+++ b/tools/perf/util/data.c
@@ -472,8 +472,7 @@ int perf_data__switch(struct perf_data *data,
pr_warning("Failed to rename %s to %s\n", data->path, *new_filepath);
if (!at_exit) {
- perf_data_file__close(&data->file);
- data->open = false;
+ perf_data__close(data);
ret = perf_data__open(data);
if (ret < 0)
goto out;
--
2.55.0.rc0.799.gd6f94ed593-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* Re: [PATCH v2 06/16] perf data: Fix directory file descriptor leak in perf_data__switch
2026-06-24 5:15 ` [PATCH v2 06/16] perf data: Fix directory file descriptor leak in perf_data__switch Ian Rogers
@ 2026-06-24 5:30 ` sashiko-bot
0 siblings, 0 replies; 74+ messages in thread
From: sashiko-bot @ 2026-06-24 5:30 UTC (permalink / raw)
To: Ian Rogers; +Cc: linux-perf-users
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] The patch introduces a Use-After-Free during file rotation in directory mode. By changing `perf_data__switch()` to call `perf_data__close()`, the `data->dir.files` array is freed. However, thread mmaps (`map->file`) still retain pointers to this freed array and are never updated. Subsequent writes dereference the freed memory.
--
commit d39defbf0b046135d95bd01181c56fe40f6a6430
Author: Ian Rogers <irogers@google.com>
perf data: Fix directory file descriptor leak in perf_data__switch
This commit fixes a file descriptor leak in perf_data__switch() when running
in directory mode. It replaces perf_data_file__close() with perf_data__close()
to properly close thread-local directory files during file rotation.
> diff --git a/tools/perf/util/data.c b/tools/perf/util/data.c
> --- a/tools/perf/util/data.c
> +++ b/tools/perf/util/data.c
> @@ -472,8 +472,7 @@ int perf_data__switch(struct perf_data *data,
> pr_warning("Failed to rename %s to %s\n", data->path, *new_filepath);
>
> if (!at_exit) {
> - perf_data_file__close(&data->file);
> - data->open = false;
> + perf_data__close(data);
[Severity: Critical]
Could this cause a use-after-free regression during file rotation?
Calling perf_data__close(data) here frees the data->dir.files array.
However, thread mmaps (like map->file) appear to still retain pointers to this
freed memory and are not updated.
For example, in tools/perf/builtin-record.c:record__write():
if (perf_data_file__write(file, bf, size) < 0) {
The file pointer here is aliased from map->file, which now points to the
freed memory. If someone runs perf record --switch-output with threads
enabled, the subsequent writes dereference these dangling pointers.
> ret = perf_data__open(data);
> if (ret < 0)
> goto out;
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260624051535.3584977-1-irogers@google.com?part=6
^ permalink raw reply [flat|nested] 74+ messages in thread
* [PATCH v2 07/16] perf test: Fix skiplist leak in cmd_test
2026-06-24 5:15 ` [PATCH v2 00/16] perf python: Fix python extension bugs from v19 review Ian Rogers
` (6 preceding siblings ...)
2026-06-24 5:15 ` [PATCH v2 06/16] perf data: Fix directory file descriptor leak in perf_data__switch Ian Rogers
@ 2026-06-24 5:15 ` Ian Rogers
2026-06-24 5:28 ` sashiko-bot
2026-06-24 5:15 ` [PATCH v2 08/16] perf python: Check counts_values size in set_values Ian Rogers
` (10 subsequent siblings)
18 siblings, 1 reply; 74+ messages in thread
From: Ian Rogers @ 2026-06-24 5:15 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
Fix a memory leak in cmd_test() where skiplist was not freed on
exit paths.
Assisted-by: Antigravity:gemini-3.1-pro
Fixes: 2ae828786c65 ("perf test: Allow skipping tests")
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/tests/builtin-test.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/tools/perf/tests/builtin-test.c b/tools/perf/tests/builtin-test.c
index 7e75f590f225..cf5625cf4f11 100644
--- a/tools/perf/tests/builtin-test.c
+++ b/tools/perf/tests/builtin-test.c
@@ -1781,9 +1781,12 @@ int cmd_test(int argc, const char **argv)
rlimit__bump_memlock();
suites = build_suites();
- if (!suites)
+ if (!suites) {
+ intlist__delete(skiplist);
return errno ? -errno : -ENOMEM;
+ }
ret = __cmd_test(suites, argc, argv, skiplist);
free(suites);
+ intlist__delete(skiplist);
return ret;
}
--
2.55.0.rc0.799.gd6f94ed593-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* Re: [PATCH v2 07/16] perf test: Fix skiplist leak in cmd_test
2026-06-24 5:15 ` [PATCH v2 07/16] perf test: Fix skiplist leak in cmd_test Ian Rogers
@ 2026-06-24 5:28 ` sashiko-bot
0 siblings, 0 replies; 74+ messages in thread
From: sashiko-bot @ 2026-06-24 5:28 UTC (permalink / raw)
To: Ian Rogers; +Cc: linux-perf-users
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Unsafe error handling: `errno` may be clobbered by cleanup functions before being evaluated.
--
commit c1a33a510193529b900f698c55a9892c973edeb2
Author: Ian Rogers <irogers@google.com>
perf test: Fix skiplist leak in cmd_test
This commit fixes a memory leak in cmd_test() by ensuring the skiplist is
properly freed on the exit paths.
> diff --git a/tools/perf/tests/builtin-test.c b/tools/perf/tests/builtin-test.c
> index 7e75f590f225e..cf5625cf4f110 100644
> --- a/tools/perf/tests/builtin-test.c
> +++ b/tools/perf/tests/builtin-test.c
[ ... ]
> @@ -1781,9 +1781,12 @@ int cmd_test(int argc, const char **argv)
> rlimit__bump_memlock();
>
> suites = build_suites();
> - if (!suites)
> + if (!suites) {
> + intlist__delete(skiplist);
> return errno ? -errno : -ENOMEM;
[Severity: Medium]
Could the call to intlist__delete() clobber errno before it is evaluated in
the return statement?
intlist__delete() cascades to rblist__delete(), which ultimately issues
free() calls. On some libc implementations or under memory sanitizers, free()
and related cleanup functions do not guarantee that errno is preserved. This
could result in returning an incorrect error code from build_suites().
> + }
> ret = __cmd_test(suites, argc, argv, skiplist);
> free(suites);
> + intlist__delete(skiplist);
> return ret;
> }
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260624051535.3584977-1-irogers@google.com?part=7
^ permalink raw reply [flat|nested] 74+ messages in thread
* [PATCH v2 08/16] perf python: Check counts_values size in set_values
2026-06-24 5:15 ` [PATCH v2 00/16] perf python: Fix python extension bugs from v19 review Ian Rogers
` (7 preceding siblings ...)
2026-06-24 5:15 ` [PATCH v2 07/16] perf test: Fix skiplist leak in cmd_test Ian Rogers
@ 2026-06-24 5:15 ` Ian Rogers
2026-06-24 7:30 ` sashiko-bot
2026-06-24 5:15 ` [PATCH v2 09/16] perf python: Validate CPU and thread maps in pyrf_evsel__open Ian Rogers
` (9 subsequent siblings)
18 siblings, 1 reply; 74+ messages in thread
From: Ian Rogers @ 2026-06-24 5:15 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
The set_values function incorrectly assumed the list contained exactly
5 elements. Add a check to prevent out-of-bounds access.
Fixes: 877108e42b1b ("perf tools: Initial python binding")
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/util/python.c | 33 +++++++++++++++++++++++++--------
1 file changed, 25 insertions(+), 8 deletions(-)
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index 550f1e7d1449..c6c729808a0f 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -1881,11 +1881,11 @@ static void pyrf_counts_values__delete(struct pyrf_counts_values *pcounts_values
0, help }
static PyMemberDef pyrf_counts_values_members[] = {
- counts_values_member_def(val, T_ULONG, "Value of event"),
- counts_values_member_def(ena, T_ULONG, "Time for which enabled"),
- counts_values_member_def(run, T_ULONG, "Time for which running"),
- counts_values_member_def(id, T_ULONG, "Unique ID for an event"),
- counts_values_member_def(lost, T_ULONG, "Num of lost samples"),
+ counts_values_member_def(val, T_ULONGLONG, "Value of event"),
+ counts_values_member_def(ena, T_ULONGLONG, "Time for which enabled"),
+ counts_values_member_def(run, T_ULONGLONG, "Time for which running"),
+ counts_values_member_def(id, T_ULONGLONG, "Unique ID for an event"),
+ counts_values_member_def(lost, T_ULONGLONG, "Num of lost samples"),
{ .name = NULL, },
};
@@ -1895,8 +1895,15 @@ static PyObject *pyrf_counts_values_get_values(struct pyrf_counts_values *self,
if (!vals)
return NULL;
- for (int i = 0; i < 5; i++)
- PyList_SetItem(vals, i, PyLong_FromLong(self->values.values[i]));
+ for (int i = 0; i < 5; i++) {
+ PyObject *val = PyLong_FromUnsignedLongLong(self->values.values[i]);
+
+ if (!val) {
+ Py_DECREF(vals);
+ return NULL;
+ }
+ PyList_SetItem(vals, i, val);
+ }
return vals;
}
@@ -1913,13 +1920,23 @@ static int pyrf_counts_values_set_values(struct pyrf_counts_values *self, PyObje
}
size = PyList_Size(list);
+ if (size != 5) {
+ PyErr_SetString(PyExc_ValueError, "List must have exactly 5 entries");
+ return -1;
+ }
+
for (Py_ssize_t i = 0; i < size; i++) {
+ unsigned long long val;
+
item = PyList_GetItem(list, i);
if (!PyLong_Check(item)) {
PyErr_SetString(PyExc_TypeError, "List members should be numbers");
return -1;
}
- self->values.values[i] = PyLong_AsLong(item);
+ val = PyLong_AsUnsignedLongLong(item);
+ if (val == (unsigned long long)-1 && PyErr_Occurred())
+ return -1;
+ self->values.values[i] = val;
}
return 0;
--
2.55.0.rc0.799.gd6f94ed593-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* Re: [PATCH v2 08/16] perf python: Check counts_values size in set_values
2026-06-24 5:15 ` [PATCH v2 08/16] perf python: Check counts_values size in set_values Ian Rogers
@ 2026-06-24 7:30 ` sashiko-bot
0 siblings, 0 replies; 74+ messages in thread
From: sashiko-bot @ 2026-06-24 7:30 UTC (permalink / raw)
To: Ian Rogers; +Cc: linux-perf-users
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
Pre-existing issues:
- [High] Deleting the `values` attribute from a `perf.counts_values` object in Python causes a segmentation fault.
- [Medium] The function `tracepoint_field` truncates 64-bit tracepoint fields on 32-bit platforms by casting them to `unsigned long` or `long`.
--
commit d69dc2f4b8c6d442757f85756430758b037c2521
Author: Ian Rogers <irogers@google.com>
perf python: Check counts_values size in set_values
The set_values function incorrectly assumed the list contained exactly
5 elements. Add a check to prevent out-of-bounds access.
> diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
> index 550f1e7d14499..c6c729808a0f2 100644
> --- a/tools/perf/util/python.c
> +++ b/tools/perf/util/python.c
[ ... ]
> @@ -1913,13 +1920,23 @@ static int pyrf_counts_values_set_values(struct pyrf_counts_values *self, PyObje
> }
>
> size = PyList_Size(list);
[Severity: High]
This isn't a bug introduced by this patch, but does
pyrf_counts_values_set_values() crash if the list parameter is NULL?
If a user deletes the attribute in Python (e.g., `del counts_values.values`),
the list parameter will be passed as NULL. The PyList_Check(list) macro called
just before this line unconditionally dereferences the pointer, which would
trigger a segmentation fault.
> + if (size != 5) {
> + PyErr_SetString(PyExc_ValueError, "List must have exactly 5 entries");
> + return -1;
> + }
> +
> for (Py_ssize_t i = 0; i < size; i++) {
[ ... ]
[Severity: Medium]
This is also a pre-existing issue, but could tracepoint_field() truncate 64-bit
values on 32-bit platforms?
In tools/perf/util/python.c:tracepoint_field():
val = tep_read_number(pevent, data + field->offset,
field->size);
if (field->flags & TEP_FIELD_IS_POINTER)
ret = PyLong_FromUnsignedLong((unsigned long) val);
else if (field->flags & TEP_FIELD_IS_SIGNED)
ret = PyLong_FromLong((long) val);
else
ret = PyLong_FromUnsignedLong((unsigned long) val);
Since val is returned by tep_read_number(), which provides a 64-bit value,
casting it to unsigned long or long drops the top 32 bits on 32-bit
architectures. Does this lead to silent data corruption for 64-bit tracepoint
fields like timestamps or counters?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260624051535.3584977-1-irogers@google.com?part=8
^ permalink raw reply [flat|nested] 74+ messages in thread
* [PATCH v2 09/16] perf python: Validate CPU and thread maps in pyrf_evsel__open
2026-06-24 5:15 ` [PATCH v2 00/16] perf python: Fix python extension bugs from v19 review Ian Rogers
` (8 preceding siblings ...)
2026-06-24 5:15 ` [PATCH v2 08/16] perf python: Check counts_values size in set_values Ian Rogers
@ 2026-06-24 5:15 ` Ian Rogers
2026-06-24 5:15 ` [PATCH v2 10/16] perf python: Validate attribute setters in pyrf_evsel Ian Rogers
` (8 subsequent siblings)
18 siblings, 0 replies; 74+ messages in thread
From: Ian Rogers @ 2026-06-24 5:15 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
Add explicit Py_TYPE checks to ensure the arguments passed are
actually of the correct pyrf_thread_map and pyrf_cpu_map types.
Fixes: 877108e42b1b ("perf tools: Initial python binding")
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/util/python.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index c6c729808a0f..4bf37e2afb18 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -2108,11 +2108,21 @@ static PyObject *pyrf_evsel__open(struct pyrf_evsel *pevsel,
&pcpus, &pthreads, &group, &inherit))
return NULL;
- if (pthreads != NULL && pthreads != Py_None)
+ if (pthreads != NULL && pthreads != Py_None) {
+ if (!PyObject_TypeCheck(pthreads, &pyrf_thread_map__type)) {
+ PyErr_SetString(PyExc_TypeError, "threads must be a thread_map");
+ return NULL;
+ }
threads = ((struct pyrf_thread_map *)pthreads)->threads;
+ }
- if (pcpus != NULL && pcpus != Py_None)
+ if (pcpus != NULL && pcpus != Py_None) {
+ if (!PyObject_TypeCheck(pcpus, &pyrf_cpu_map__type)) {
+ PyErr_SetString(PyExc_TypeError, "cpus must be a cpu_map");
+ return NULL;
+ }
cpus = ((struct pyrf_cpu_map *)pcpus)->cpus;
+ }
evsel->core.attr.inherit = inherit;
/*
--
2.55.0.rc0.799.gd6f94ed593-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* [PATCH v2 10/16] perf python: Validate attribute setters in pyrf_evsel
2026-06-24 5:15 ` [PATCH v2 00/16] perf python: Fix python extension bugs from v19 review Ian Rogers
` (9 preceding siblings ...)
2026-06-24 5:15 ` [PATCH v2 09/16] perf python: Validate CPU and thread maps in pyrf_evsel__open Ian Rogers
@ 2026-06-24 5:15 ` Ian Rogers
2026-06-24 5:31 ` sashiko-bot
2026-06-24 5:15 ` [PATCH v2 11/16] perf python: Zero initialize perf_data in pyrf_data__init Ian Rogers
` (7 subsequent siblings)
18 siblings, 1 reply; 74+ messages in thread
From: Ian Rogers @ 2026-06-24 5:15 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
If val is NULL when setting an attribute, PyErr_SetString should be
called as deleting the attribute isn't supported. In addition, ensure
PyErr_Occurred is checked before setting the attribute to avoid setting
a garbage value.
Fixes: 877108e42b1b ("perf tools: Initial python binding")
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/util/python.c | 89 ++++++++++++++++++++++++++++++++++------
1 file changed, 77 insertions(+), 12 deletions(-)
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index 4bf37e2afb18..657b054f5e51 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -2296,6 +2296,11 @@ static int pyrf_evsel__set_tracking(PyObject *self, PyObject *val, void *closure
CHECK_INITIALIZED_INT(pevsel->evsel, "evsel");
+ if (val == NULL) {
+ PyErr_SetString(PyExc_TypeError, "cannot delete attribute");
+ return -1;
+ }
+
is_true = PyObject_IsTrue(val);
if (is_true < 0)
return -1;
@@ -2307,11 +2312,21 @@ static int pyrf_evsel__set_tracking(PyObject *self, PyObject *val, void *closure
static int pyrf_evsel__set_attr_config(PyObject *self, PyObject *val, void *closure __maybe_unused)
{
struct pyrf_evsel *pevsel = (void *)self;
+ unsigned long long new_val;
CHECK_INITIALIZED_INT(pevsel->evsel, "evsel");
- pevsel->evsel->core.attr.config = PyLong_AsUnsignedLongLong(val);
- return PyErr_Occurred() ? -1 : 0;
+ if (val == NULL) {
+ PyErr_SetString(PyExc_TypeError, "cannot delete attribute");
+ return -1;
+ }
+
+ new_val = PyLong_AsUnsignedLongLong(val);
+ if (PyErr_Occurred())
+ return -1;
+
+ pevsel->evsel->core.attr.config = new_val;
+ return 0;
}
static PyObject *pyrf_evsel__get_attr_config(PyObject *self, void *closure __maybe_unused)
@@ -2326,11 +2341,21 @@ static PyObject *pyrf_evsel__get_attr_config(PyObject *self, void *closure __may
static int pyrf_evsel__set_attr_read_format(PyObject *self, PyObject *val, void *closure __maybe_unused)
{
struct pyrf_evsel *pevsel = (void *)self;
+ unsigned long long new_val;
CHECK_INITIALIZED_INT(pevsel->evsel, "evsel");
- pevsel->evsel->core.attr.read_format = PyLong_AsUnsignedLongLong(val);
- return PyErr_Occurred() ? -1 : 0;
+ if (val == NULL) {
+ PyErr_SetString(PyExc_TypeError, "cannot delete attribute");
+ return -1;
+ }
+
+ new_val = PyLong_AsUnsignedLongLong(val);
+ if (PyErr_Occurred())
+ return -1;
+
+ pevsel->evsel->core.attr.read_format = new_val;
+ return 0;
}
static PyObject *pyrf_evsel__get_attr_read_format(PyObject *self, void *closure __maybe_unused)
@@ -2345,11 +2370,21 @@ static PyObject *pyrf_evsel__get_attr_read_format(PyObject *self, void *closure
static int pyrf_evsel__set_attr_sample_period(PyObject *self, PyObject *val, void *closure __maybe_unused)
{
struct pyrf_evsel *pevsel = (void *)self;
+ unsigned long long new_val;
CHECK_INITIALIZED_INT(pevsel->evsel, "evsel");
- pevsel->evsel->core.attr.sample_period = PyLong_AsUnsignedLongLong(val);
- return PyErr_Occurred() ? -1 : 0;
+ if (val == NULL) {
+ PyErr_SetString(PyExc_TypeError, "cannot delete attribute");
+ return -1;
+ }
+
+ new_val = PyLong_AsUnsignedLongLong(val);
+ if (PyErr_Occurred())
+ return -1;
+
+ pevsel->evsel->core.attr.sample_period = new_val;
+ return 0;
}
static PyObject *pyrf_evsel__get_attr_sample_period(PyObject *self, void *closure __maybe_unused)
@@ -2364,11 +2399,21 @@ static PyObject *pyrf_evsel__get_attr_sample_period(PyObject *self, void *closur
static int pyrf_evsel__set_attr_sample_type(PyObject *self, PyObject *val, void *closure __maybe_unused)
{
struct pyrf_evsel *pevsel = (void *)self;
+ unsigned long long new_val;
CHECK_INITIALIZED_INT(pevsel->evsel, "evsel");
- pevsel->evsel->core.attr.sample_type = PyLong_AsUnsignedLongLong(val);
- return PyErr_Occurred() ? -1 : 0;
+ if (val == NULL) {
+ PyErr_SetString(PyExc_TypeError, "cannot delete attribute");
+ return -1;
+ }
+
+ new_val = PyLong_AsUnsignedLongLong(val);
+ if (PyErr_Occurred())
+ return -1;
+
+ pevsel->evsel->core.attr.sample_type = new_val;
+ return 0;
}
static PyObject *pyrf_evsel__get_attr_sample_type(PyObject *self, void *closure __maybe_unused)
@@ -2392,11 +2437,21 @@ static PyObject *pyrf_evsel__get_attr_size(PyObject *self, void *closure __maybe
static int pyrf_evsel__set_attr_type(PyObject *self, PyObject *val, void *closure __maybe_unused)
{
struct pyrf_evsel *pevsel = (void *)self;
+ unsigned long new_val;
CHECK_INITIALIZED_INT(pevsel->evsel, "evsel");
- pevsel->evsel->core.attr.type = PyLong_AsUnsignedLong(val);
- return PyErr_Occurred() ? -1 : 0;
+ if (val == NULL) {
+ PyErr_SetString(PyExc_TypeError, "cannot delete attribute");
+ return -1;
+ }
+
+ new_val = PyLong_AsUnsignedLong(val);
+ if (PyErr_Occurred())
+ return -1;
+
+ pevsel->evsel->core.attr.type = new_val;
+ return 0;
}
static PyObject *pyrf_evsel__get_attr_type(PyObject *self, void *closure __maybe_unused)
@@ -2411,11 +2466,21 @@ static PyObject *pyrf_evsel__get_attr_type(PyObject *self, void *closure __maybe
static int pyrf_evsel__set_attr_wakeup_events(PyObject *self, PyObject *val, void *closure __maybe_unused)
{
struct pyrf_evsel *pevsel = (void *)self;
+ unsigned long new_val;
CHECK_INITIALIZED_INT(pevsel->evsel, "evsel");
- pevsel->evsel->core.attr.wakeup_events = PyLong_AsUnsignedLong(val);
- return PyErr_Occurred() ? -1 : 0;
+ if (val == NULL) {
+ PyErr_SetString(PyExc_TypeError, "cannot delete attribute");
+ return -1;
+ }
+
+ new_val = PyLong_AsUnsignedLong(val);
+ if (PyErr_Occurred())
+ return -1;
+
+ pevsel->evsel->core.attr.wakeup_events = new_val;
+ return 0;
}
static PyObject *pyrf_evsel__get_attr_wakeup_events(PyObject *self, void *closure __maybe_unused)
--
2.55.0.rc0.799.gd6f94ed593-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* Re: [PATCH v2 10/16] perf python: Validate attribute setters in pyrf_evsel
2026-06-24 5:15 ` [PATCH v2 10/16] perf python: Validate attribute setters in pyrf_evsel Ian Rogers
@ 2026-06-24 5:31 ` sashiko-bot
0 siblings, 0 replies; 74+ messages in thread
From: sashiko-bot @ 2026-06-24 5:31 UTC (permalink / raw)
To: Ian Rogers; +Cc: linux-perf-users
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [Medium] Missing NULL check for attribute deletion in `pyrf_counts_values_set_values` causes a segmentation fault.
--
commit 921733bf92d5e6634715543526c3d25b8346f3c3
Author: Ian Rogers <irogers@google.com>
perf python: Validate attribute setters in pyrf_evsel
This commit adds NULL checks to attribute setters in pyrf_evsel to
ensure an error is correctly reported instead of setting a garbage
value when attempting to delete an attribute.
> diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
> index 4bf37e2afb18d..657b054f5e515 100644
> --- a/tools/perf/util/python.c
> +++ b/tools/perf/util/python.c
[ ... ]
> @@ -2296,6 +2296,11 @@ static int pyrf_evsel__set_tracking(PyObject *self, PyObject *val, void *closure
>
> CHECK_INITIALIZED_INT(pevsel->evsel, "evsel");
>
> + if (val == NULL) {
> + PyErr_SetString(PyExc_TypeError, "cannot delete attribute");
> + return -1;
> + }
> +
> is_true = PyObject_IsTrue(val);
> if (is_true < 0)
> return -1;
[Severity: Medium]
This is a pre-existing issue, but since you are fixing these attribute
deletion issues in pyrf_evsel, should we also fix
pyrf_counts_values_set_values in the same file?
Looking at pyrf_counts_values_set_values, the list parameter is passed
directly to PyList_Check without verifying if it is NULL:
static int pyrf_counts_values_set_values(struct pyrf_counts_values *self,
PyObject *list, void *closure)
{
Py_ssize_t size;
PyObject *item = NULL;
if (!PyList_Check(list)) {
PyErr_SetString(PyExc_TypeError, "Value assigned must be a list");
return -1;
}
Could deleting the counts_values.values attribute from a Python script
trigger a segmentation fault here?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260624051535.3584977-1-irogers@google.com?part=10
^ permalink raw reply [flat|nested] 74+ messages in thread
* [PATCH v2 11/16] perf python: Zero initialize perf_data in pyrf_data__init
2026-06-24 5:15 ` [PATCH v2 00/16] perf python: Fix python extension bugs from v19 review Ian Rogers
` (10 preceding siblings ...)
2026-06-24 5:15 ` [PATCH v2 10/16] perf python: Validate attribute setters in pyrf_evsel Ian Rogers
@ 2026-06-24 5:15 ` Ian Rogers
2026-06-24 5:15 ` [PATCH v2 12/16] perf python: Add thread and PMU uninitialized checks Ian Rogers
` (6 subsequent siblings)
18 siblings, 0 replies; 74+ messages in thread
From: Ian Rogers @ 2026-06-24 5:15 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
Replace path clearing with memset so the entire struct is zeroed,
preventing uninitialized fields from causing errors later.
Fixes: 4cd0142f7dec ("perf python: Add wrapper for perf_data file abstraction")
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/util/python.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index 657b054f5e51..71be130b38c5 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -3,6 +3,7 @@
#include <Python.h>
#include <inttypes.h>
+#include <string.h>
#include <linux/err.h>
#include <poll.h>
@@ -3621,7 +3622,7 @@ static int pyrf_data__init(struct pyrf_data *pdata, PyObject *args, PyObject *kw
if (pdata->data.open)
perf_data__close(&pdata->data);
free((char *)pdata->data.path);
- pdata->data.path = NULL;
+ memset(&pdata->data, 0, sizeof(pdata->data));
if (fd != -1) {
struct stat st;
--
2.55.0.rc0.799.gd6f94ed593-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* [PATCH v2 12/16] perf python: Add thread and PMU uninitialized checks
2026-06-24 5:15 ` [PATCH v2 00/16] perf python: Fix python extension bugs from v19 review Ian Rogers
` (11 preceding siblings ...)
2026-06-24 5:15 ` [PATCH v2 11/16] perf python: Zero initialize perf_data in pyrf_data__init Ian Rogers
@ 2026-06-24 5:15 ` Ian Rogers
2026-06-24 5:34 ` sashiko-bot
2026-06-24 5:15 ` [PATCH v2 13/16] perf python: Fix MetricGroup return type in perf.pyi Ian Rogers
` (5 subsequent siblings)
18 siblings, 1 reply; 74+ messages in thread
From: Ian Rogers @ 2026-06-24 5:15 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
Add CHECK_INITIALIZED checks to the thread attribute getters
(get_pid, get_tid, get_ppid) to prevent crashes if they are accessed
before being properly initialized.
Fixes: 3b96bf7af60d ("perf python: Add python session abstraction wrapping perf's session")
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/util/python.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index 71be130b38c5..b17b191b1625 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -1678,6 +1678,7 @@ static PyObject *pyrf_pmu__name(PyObject *self)
{
struct pyrf_pmu *ppmu = (void *)self;
+ CHECK_INITIALIZED(ppmu->pmu, "pmu");
return PyUnicode_FromString(ppmu->pmu->name);
}
@@ -1730,6 +1731,8 @@ static PyObject *pyrf_pmu__events(PyObject *self)
PyObject *py_list = PyList_New(0);
int ret;
+ CHECK_INITIALIZED(ppmu->pmu, "pmu");
+
if (!py_list)
return NULL;
@@ -3758,21 +3761,25 @@ static PyMethodDef pyrf_thread__methods[] = {
static PyObject *pyrf_thread__get_pid(struct pyrf_thread *pthread, void *closure __maybe_unused)
{
+ CHECK_INITIALIZED(pthread->thread, "thread");
return PyLong_FromLong(thread__pid(pthread->thread));
}
static PyObject *pyrf_thread__get_tid(struct pyrf_thread *pthread, void *closure __maybe_unused)
{
+ CHECK_INITIALIZED(pthread->thread, "thread");
return PyLong_FromLong(thread__tid(pthread->thread));
}
static PyObject *pyrf_thread__get_ppid(struct pyrf_thread *pthread, void *closure __maybe_unused)
{
+ CHECK_INITIALIZED(pthread->thread, "thread");
return PyLong_FromLong(thread__ppid(pthread->thread));
}
static PyObject *pyrf_thread__get_cpu(struct pyrf_thread *pthread, void *closure __maybe_unused)
{
+ CHECK_INITIALIZED(pthread->thread, "thread");
return PyLong_FromLong(thread__cpu(pthread->thread));
}
--
2.55.0.rc0.799.gd6f94ed593-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* Re: [PATCH v2 12/16] perf python: Add thread and PMU uninitialized checks
2026-06-24 5:15 ` [PATCH v2 12/16] perf python: Add thread and PMU uninitialized checks Ian Rogers
@ 2026-06-24 5:34 ` sashiko-bot
0 siblings, 0 replies; 74+ messages in thread
From: sashiko-bot @ 2026-06-24 5:34 UTC (permalink / raw)
To: Ian Rogers; +Cc: linux-perf-users
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The newly added CHECK_INITIALIZED macro in pyrf_pmu__events() leaks the py_list object when the pmu is not initialized.
--
commit 579d96b72f035d8f31919edd0270e2cfa16975d3
Author: Ian Rogers <irogers@google.com>
perf python: Add thread and PMU uninitialized checks
Add CHECK_INITIALIZED checks to the thread attribute getters
(get_pid, get_tid, get_ppid) to prevent crashes if they are accessed
before being properly initialized.
> diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
> index 71be130b38c53..b17b191b16255 100644
> --- a/tools/perf/util/python.c
> +++ b/tools/perf/util/python.c
[ ... ]
> @@ -1730,6 +1731,8 @@ static PyObject *pyrf_pmu__events(PyObject *self)
> PyObject *py_list = PyList_New(0);
> int ret;
>
> + CHECK_INITIALIZED(ppmu->pmu, "pmu");
> +
[Severity: Medium]
If ppmu->pmu is uninitialized, won't this newly added check return early
and leak the py_list object allocated just above it?
Would it make sense to move the CHECK_INITIALIZED() macro before the
PyList_New(0) allocation?
> if (!py_list)
> return NULL;
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260624051535.3584977-1-irogers@google.com?part=12
^ permalink raw reply [flat|nested] 74+ messages in thread
* [PATCH v2 13/16] perf python: Fix MetricGroup return type in perf.pyi
2026-06-24 5:15 ` [PATCH v2 00/16] perf python: Fix python extension bugs from v19 review Ian Rogers
` (12 preceding siblings ...)
2026-06-24 5:15 ` [PATCH v2 12/16] perf python: Add thread and PMU uninitialized checks Ian Rogers
@ 2026-06-24 5:15 ` Ian Rogers
2026-06-24 5:15 ` [PATCH v2 14/16] perf python: Fix count_values memory leak in pyrf_evsel__read Ian Rogers
` (4 subsequent siblings)
18 siblings, 0 replies; 74+ messages in thread
From: Ian Rogers @ 2026-06-24 5:15 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
The metrics() function can return a dictionary where the value is either
a string or a list of strings, so the type signature in the stub file
should be Union[str, List[str]].
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/python/perf.pyi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/perf/python/perf.pyi b/tools/perf/python/perf.pyi
index f266c9baffd0..58b0b3ed819d 100644
--- a/tools/perf/python/perf.pyi
+++ b/tools/perf/python/perf.pyi
@@ -1,5 +1,5 @@
"""Type stubs for the perf Python module."""
-from typing import Callable, Dict, List, Optional, Any, Iterator
+from typing import Callable, Dict, List, Optional, Any, Iterator, Union
def config_get(name: str) -> Optional[str]:
"""Get a configuration value from perf config.
@@ -12,7 +12,7 @@ def config_get(name: str) -> Optional[str]:
"""
...
-def metrics() -> List[Dict[str, str]]:
+def metrics() -> List[Dict[str, Union[str, List[str]]]]:
"""Get a list of available metrics.
Returns:
--
2.55.0.rc0.799.gd6f94ed593-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* [PATCH v2 14/16] perf python: Fix count_values memory leak in pyrf_evsel__read
2026-06-24 5:15 ` [PATCH v2 00/16] perf python: Fix python extension bugs from v19 review Ian Rogers
` (13 preceding siblings ...)
2026-06-24 5:15 ` [PATCH v2 13/16] perf python: Fix MetricGroup return type in perf.pyi Ian Rogers
@ 2026-06-24 5:15 ` Ian Rogers
2026-06-24 5:39 ` sashiko-bot
2026-06-24 5:15 ` [PATCH v2 15/16] perf python: Fix memory leak in pyrf__metrics_cb Ian Rogers
` (3 subsequent siblings)
18 siblings, 1 reply; 74+ messages in thread
From: Ian Rogers @ 2026-06-24 5:15 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
In pyrf_evsel__read, if PyArg_ParseTuple fails, the allocated count_values
is leaked. Move the allocation of count_values after the PyArg_ParseTuple
call to prevent the memory leak.
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/util/python.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index b17b191b1625..e76a407cb2bb 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -2204,11 +2204,6 @@ static PyObject *pyrf_evsel__read(struct pyrf_evsel *pevsel,
CHECK_INITIALIZED(evsel, "evsel");
- count_values = PyObject_New(struct pyrf_counts_values,
- &pyrf_counts_values__type);
- if (!count_values)
- return NULL;
-
if (!PyArg_ParseTuple(args, "ii", &cpu, &thread))
return NULL;
@@ -2227,6 +2222,10 @@ static PyObject *pyrf_evsel__read(struct pyrf_evsel *pevsel,
if (evsel__ensure_counts(evsel))
return PyErr_NoMemory();
+ count_values = PyObject_New(struct pyrf_counts_values, &pyrf_counts_values__type);
+ if (!count_values)
+ return NULL;
+
/* Set up pointers to the old and newly read counter values. */
old_count = perf_counts(evsel->prev_raw_counts, cpu_idx, thread_idx);
new_count = perf_counts(evsel->counts, cpu_idx, thread_idx);
--
2.55.0.rc0.799.gd6f94ed593-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* Re: [PATCH v2 14/16] perf python: Fix count_values memory leak in pyrf_evsel__read
2026-06-24 5:15 ` [PATCH v2 14/16] perf python: Fix count_values memory leak in pyrf_evsel__read Ian Rogers
@ 2026-06-24 5:39 ` sashiko-bot
0 siblings, 0 replies; 74+ messages in thread
From: sashiko-bot @ 2026-06-24 5:39 UTC (permalink / raw)
To: Ian Rogers; +Cc: linux-perf-users
Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
Pre-existing issues:
- [High] A partially failed allocation in `evsel__ensure_counts()` results in a NULL pointer dereference when retrying `pyrf_evsel__read()`.
- [High] The `evsel->prev_raw_counts` array allocated for Python `perf.evsel` objects is unconditionally leaked when the object is destroyed.
- [Medium] String duplication leak in `prepare_metric` on error paths.
--
commit 0bdfb7eb04b252f781d1daa5947d46bec1d9df82
Author: Ian Rogers <irogers@google.com>
perf python: Fix count_values memory leak in pyrf_evsel__read
In pyrf_evsel__read, if PyArg_ParseTuple fails, the allocated count_values
is leaked. Move the allocation of count_values after the PyArg_ParseTuple
call to prevent the memory leak.
> diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
> index b17b191b16255..e76a407cb2bb9 100644
> --- a/tools/perf/util/python.c
> +++ b/tools/perf/util/python.c
> @@ -2204,11 +2204,6 @@ static PyObject *pyrf_evsel__read(struct pyrf_evsel *pevsel,
>
> CHECK_INITIALIZED(evsel, "evsel");
>
> - count_values = PyObject_New(struct pyrf_counts_values,
> - &pyrf_counts_values__type);
> - if (!count_values)
> - return NULL;
> -
> if (!PyArg_ParseTuple(args, "ii", &cpu, &thread))
> return NULL;
>
> @@ -2227,6 +2222,10 @@ static PyObject *pyrf_evsel__read(struct pyrf_evsel *pevsel,
> if (evsel__ensure_counts(evsel))
> return PyErr_NoMemory();
>
> + count_values = PyObject_New(struct pyrf_counts_values, &pyrf_counts_values__type);
> + if (!count_values)
> + return NULL;
> +
> /* Set up pointers to the old and newly read counter values. */
> old_count = perf_counts(evsel->prev_raw_counts, cpu_idx, thread_idx);
[Severity: High]
This isn't a bug introduced by this patch, but I noticed a potential NULL
pointer dereference here.
If evsel__ensure_counts() successfully allocates evsel->counts but fails to
allocate evsel->prev_raw_counts, it returns -ENOMEM. If a user script
handles the resulting Python MemoryError and retries the read operation,
evsel__ensure_counts() will see that evsel->counts is no longer NULL and
return success immediately, without allocating evsel->prev_raw_counts.
Will this cause perf_counts() to dereference a NULL prev_raw_counts pointer
on the retry?
[Severity: High]
This is also a pre-existing issue, but does evsel->prev_raw_counts leak
when the object is destroyed?
When a standalone Python evsel object is destroyed, its destruction path
goes through pyrf_evsel__delete() -> evsel__put() -> evsel__exit(). While
evsel__exit() properly calls evsel__free_counts() to free evsel->counts,
it seems to miss freeing evsel->prev_raw_counts.
Could this unconditionally drain memory if Python evsel objects are used in
a loop?
> new_count = perf_counts(evsel->counts, cpu_idx, thread_idx);
[ ... ]
[Severity: Medium]
This is another pre-existing issue not caused by this patch, but looking at
prepare_metric() in the same file, does this error path leak the duplicated
string n?
tools/perf/util/python.c:prepare_metric() {
...
char *n = strdup(evsel__metric_id(cur));
if (!n)
return -ENOMEM;
...
ret = evsel__ensure_counts(cur);
if (ret)
return ret;
...
ret = expr__add_id_val_source_count(pctx, n, val, source_count);
if (ret)
return ret;
...
}
If evsel__ensure_counts() or expr__add_id_val_source_count() returns an
error, the function returns early without freeing n. Should we ensure n is
freed on these error paths?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260624051535.3584977-1-irogers@google.com?part=14
^ permalink raw reply [flat|nested] 74+ messages in thread
* [PATCH v2 15/16] perf python: Fix memory leak in pyrf__metrics_cb
2026-06-24 5:15 ` [PATCH v2 00/16] perf python: Fix python extension bugs from v19 review Ian Rogers
` (14 preceding siblings ...)
2026-06-24 5:15 ` [PATCH v2 14/16] perf python: Fix count_values memory leak in pyrf_evsel__read Ian Rogers
@ 2026-06-24 5:15 ` Ian Rogers
2026-06-24 5:15 ` [PATCH v2 16/16] perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads Ian Rogers
` (2 subsequent siblings)
18 siblings, 0 replies; 74+ messages in thread
From: Ian Rogers @ 2026-06-24 5:15 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
In pyrf__metrics_cb, PyDict_SetItem does not steal the reference of the
key and value, so they need to be decref'ed after successful insertion
to avoid memory leaks.
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/util/python.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index e76a407cb2bb..5471037d04c5 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -3567,6 +3567,8 @@ static int pyrf__metrics_cb(const struct pmu_metric *pm,
Py_XDECREF(dict);
return -ENOMEM;
}
+ Py_DECREF(key);
+ Py_DECREF(value);
if (!add_to_dict(dict, "MetricName", pm->metric_name) ||
!add_to_dict(dict, "PMU", pm->pmu) ||
--
2.55.0.rc0.799.gd6f94ed593-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* [PATCH v2 16/16] perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads
2026-06-24 5:15 ` [PATCH v2 00/16] perf python: Fix python extension bugs from v19 review Ian Rogers
` (15 preceding siblings ...)
2026-06-24 5:15 ` [PATCH v2 15/16] perf python: Fix memory leak in pyrf__metrics_cb Ian Rogers
@ 2026-06-24 5:15 ` Ian Rogers
2026-07-04 16:54 ` [PATCH v2 00/16] perf python: Fix python extension bugs from v19 review Namhyung Kim
2026-08-09 7:14 ` [PATCH v3 00/15] " Ian Rogers
18 siblings, 0 replies; 74+ messages in thread
From: Ian Rogers @ 2026-06-24 5:15 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
If scandir() finds no matching tasks in /proc, n is 0. If thread_nr is > 1,
we bypass the single-thread fast path and then clamp thread_nr to n, making
it 0. This results in a divide by zero when calculating num_per_thread.
Handle n <= 1 early to use the single-thread fast path and prevent the
crash.
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/util/synthetic-events.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic-events.c
index 35de41ad14d3..19c1f3eaf58d 100644
--- a/tools/perf/util/synthetic-events.c
+++ b/tools/perf/util/synthetic-events.c
@@ -1058,7 +1058,7 @@ int perf_event__synthesize_threads(const struct perf_tool *tool,
else
thread_nr = nr_threads_synthesize;
- if (thread_nr <= 1) {
+ if (thread_nr <= 1 || n <= 1) {
err = __perf_event__synthesize_threads(tool, process,
machine,
needs_mmap, mmap_data,
--
2.55.0.rc0.799.gd6f94ed593-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* Re: [PATCH v2 00/16] perf python: Fix python extension bugs from v19 review
2026-06-24 5:15 ` [PATCH v2 00/16] perf python: Fix python extension bugs from v19 review Ian Rogers
` (16 preceding siblings ...)
2026-06-24 5:15 ` [PATCH v2 16/16] perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads Ian Rogers
@ 2026-07-04 16:54 ` Namhyung Kim
2026-07-04 23:03 ` Ian Rogers
2026-08-09 7:14 ` [PATCH v3 00/15] " Ian Rogers
18 siblings, 1 reply; 74+ messages in thread
From: Namhyung Kim @ 2026-07-04 16:54 UTC (permalink / raw)
To: Ian Rogers
Cc: acme, adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark,
leo.yan, linux-kernel, linux-perf-users, mingo, peterz, tmricht
Hi Ian,
On Tue, Jun 23, 2026 at 10:15:17PM -0700, Ian Rogers wrote:
> Phase 1 of splitting the v19 review patches into smaller fixes.
> These patches address issues identified in the python extension during
> the review of the v19 script porting series, as well as fixing several
> pre-existing bugs and leaks.
>
> v2:
> - Addressed sashiko review feedback:
> - Fixed 64-bit casting for counts_values by using T_ULONGLONG and PyLong_FromUnsignedLongLong.
> - Replaced strict Py_TYPE checks with PyObject_TypeCheck for thread/cpu maps.
> - Fixed a missing CHECK_INITIALIZED for pyrf_thread__get_cpu, pyrf_pmu__name, pyrf_pmu__events.
> - Included <string.h> where memset was used.
> - Fixed line splitting formatting on PyObject_New in pyrf_evsel__read.
> - Added fixes for memory leaks and issues discovered during review:
> - Fix memory leak of key and value in pyrf__metrics_cb
> - Fix count_values memory leak in pyrf_evsel__read
> - Fix sb_evlist leaks in both top and record paths.
> - Fix potential divide by zero in perf_event__synthesize_threads
>
> v1:
> - Decomposed the single large "Fix python extension bugs" patch into 13 individual fixes.
> - Added Fixes: tags for issues that date back to earlier commits.
> - Addressed checkpatch warnings (line lengths, Signed-off-by, etc).
>
>
> Ian Rogers (16):
> perf script: Fix metric_evlist leak in script_find_metrics
> perf stat: Fix evsel_list leak in cmd_stat
> perf tools: Fix sb_evlist leaks in top and record
> perf python: Fix memory leak in pyrf_evlist__get_pollfd
> perf synthetic-events: Fix uninitialized pthread_join
> perf data: Fix directory file descriptor leak in perf_data__switch
> perf test: Fix skiplist leak in cmd_test
> perf python: Check counts_values size in set_values
> perf python: Validate CPU and thread maps in pyrf_evsel__open
> perf python: Validate attribute setters in pyrf_evsel
> perf python: Zero initialize perf_data in pyrf_data__init
> perf python: Add thread and PMU uninitialized checks
> perf python: Fix MetricGroup return type in perf.pyi
> perf python: Fix count_values memory leak in pyrf_evsel__read
> perf python: Fix memory leak in pyrf__metrics_cb
> perf synthetic-events: Fix divide by zero in
> perf_event__synthesize_threads
Will you send v3? You don't need to fix all pre-existing issues but we
should not introduce new bugs or regressions. I think some of Sashiko
comments found them like data switch and pmu init checks.
Thanks,
Namhyung
>
> tools/perf/builtin-record.c | 2 +
> tools/perf/builtin-script.c | 2 +-
> tools/perf/builtin-stat.c | 9 +-
> tools/perf/builtin-top.c | 2 +
> tools/perf/python/perf.pyi | 4 +-
> tools/perf/tests/builtin-test.c | 5 +-
> tools/perf/util/data.c | 3 +-
> tools/perf/util/python.c | 160 ++++++++++++++++++++++++-----
> tools/perf/util/synthetic-events.c | 6 +-
> 9 files changed, 153 insertions(+), 40 deletions(-)
>
> --
> 2.55.0.rc0.799.gd6f94ed593-goog
>
^ permalink raw reply [flat|nested] 74+ messages in thread* Re: [PATCH v2 00/16] perf python: Fix python extension bugs from v19 review
2026-07-04 16:54 ` [PATCH v2 00/16] perf python: Fix python extension bugs from v19 review Namhyung Kim
@ 2026-07-04 23:03 ` Ian Rogers
2026-07-06 23:49 ` Namhyung Kim
0 siblings, 1 reply; 74+ messages in thread
From: Ian Rogers @ 2026-07-04 23:03 UTC (permalink / raw)
To: Namhyung Kim
Cc: acme, adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark,
leo.yan, linux-kernel, linux-perf-users, mingo, peterz, tmricht
On Sat, Jul 4, 2026 at 9:54 AM Namhyung Kim <namhyung@kernel.org> wrote:
>
> Hi Ian,
>
> On Tue, Jun 23, 2026 at 10:15:17PM -0700, Ian Rogers wrote:
> > Phase 1 of splitting the v19 review patches into smaller fixes.
> > These patches address issues identified in the python extension during
> > the review of the v19 script porting series, as well as fixing several
> > pre-existing bugs and leaks.
> >
> > v2:
> > - Addressed sashiko review feedback:
> > - Fixed 64-bit casting for counts_values by using T_ULONGLONG and PyLong_FromUnsignedLongLong.
> > - Replaced strict Py_TYPE checks with PyObject_TypeCheck for thread/cpu maps.
> > - Fixed a missing CHECK_INITIALIZED for pyrf_thread__get_cpu, pyrf_pmu__name, pyrf_pmu__events.
> > - Included <string.h> where memset was used.
> > - Fixed line splitting formatting on PyObject_New in pyrf_evsel__read.
> > - Added fixes for memory leaks and issues discovered during review:
> > - Fix memory leak of key and value in pyrf__metrics_cb
> > - Fix count_values memory leak in pyrf_evsel__read
> > - Fix sb_evlist leaks in both top and record paths.
> > - Fix potential divide by zero in perf_event__synthesize_threads
> >
> > v1:
> > - Decomposed the single large "Fix python extension bugs" patch into 13 individual fixes.
> > - Added Fixes: tags for issues that date back to earlier commits.
> > - Addressed checkpatch warnings (line lengths, Signed-off-by, etc).
> >
> >
> > Ian Rogers (16):
> > perf script: Fix metric_evlist leak in script_find_metrics
> > perf stat: Fix evsel_list leak in cmd_stat
> > perf tools: Fix sb_evlist leaks in top and record
> > perf python: Fix memory leak in pyrf_evlist__get_pollfd
> > perf synthetic-events: Fix uninitialized pthread_join
> > perf data: Fix directory file descriptor leak in perf_data__switch
> > perf test: Fix skiplist leak in cmd_test
> > perf python: Check counts_values size in set_values
> > perf python: Validate CPU and thread maps in pyrf_evsel__open
> > perf python: Validate attribute setters in pyrf_evsel
> > perf python: Zero initialize perf_data in pyrf_data__init
> > perf python: Add thread and PMU uninitialized checks
> > perf python: Fix MetricGroup return type in perf.pyi
> > perf python: Fix count_values memory leak in pyrf_evsel__read
> > perf python: Fix memory leak in pyrf__metrics_cb
> > perf synthetic-events: Fix divide by zero in
> > perf_event__synthesize_threads
>
> Will you send v3? You don't need to fix all pre-existing issues but we
> should not introduce new bugs or regressions. I think some of Sashiko
> comments found them like data switch and pmu init checks.
Thanks Namhyung, I have a v3 coming. I'm working with Sashiko locally
and trying to address as many issues as possible, including minor
pre-existing ones—it's easier than remembering to clean them up later.
Ian
> Thanks,
> Namhyung
>
> >
> > tools/perf/builtin-record.c | 2 +
> > tools/perf/builtin-script.c | 2 +-
> > tools/perf/builtin-stat.c | 9 +-
> > tools/perf/builtin-top.c | 2 +
> > tools/perf/python/perf.pyi | 4 +-
> > tools/perf/tests/builtin-test.c | 5 +-
> > tools/perf/util/data.c | 3 +-
> > tools/perf/util/python.c | 160 ++++++++++++++++++++++++-----
> > tools/perf/util/synthetic-events.c | 6 +-
> > 9 files changed, 153 insertions(+), 40 deletions(-)
> >
> > --
> > 2.55.0.rc0.799.gd6f94ed593-goog
> >
^ permalink raw reply [flat|nested] 74+ messages in thread
* Re: [PATCH v2 00/16] perf python: Fix python extension bugs from v19 review
2026-07-04 23:03 ` Ian Rogers
@ 2026-07-06 23:49 ` Namhyung Kim
0 siblings, 0 replies; 74+ messages in thread
From: Namhyung Kim @ 2026-07-06 23:49 UTC (permalink / raw)
To: Ian Rogers
Cc: acme, adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark,
leo.yan, linux-kernel, linux-perf-users, mingo, peterz, tmricht
On Sat, Jul 04, 2026 at 04:03:18PM -0700, Ian Rogers wrote:
> On Sat, Jul 4, 2026 at 9:54 AM Namhyung Kim <namhyung@kernel.org> wrote:
> >
> > Hi Ian,
> >
> > On Tue, Jun 23, 2026 at 10:15:17PM -0700, Ian Rogers wrote:
> > > Phase 1 of splitting the v19 review patches into smaller fixes.
> > > These patches address issues identified in the python extension during
> > > the review of the v19 script porting series, as well as fixing several
> > > pre-existing bugs and leaks.
> > >
> > > v2:
> > > - Addressed sashiko review feedback:
> > > - Fixed 64-bit casting for counts_values by using T_ULONGLONG and PyLong_FromUnsignedLongLong.
> > > - Replaced strict Py_TYPE checks with PyObject_TypeCheck for thread/cpu maps.
> > > - Fixed a missing CHECK_INITIALIZED for pyrf_thread__get_cpu, pyrf_pmu__name, pyrf_pmu__events.
> > > - Included <string.h> where memset was used.
> > > - Fixed line splitting formatting on PyObject_New in pyrf_evsel__read.
> > > - Added fixes for memory leaks and issues discovered during review:
> > > - Fix memory leak of key and value in pyrf__metrics_cb
> > > - Fix count_values memory leak in pyrf_evsel__read
> > > - Fix sb_evlist leaks in both top and record paths.
> > > - Fix potential divide by zero in perf_event__synthesize_threads
> > >
> > > v1:
> > > - Decomposed the single large "Fix python extension bugs" patch into 13 individual fixes.
> > > - Added Fixes: tags for issues that date back to earlier commits.
> > > - Addressed checkpatch warnings (line lengths, Signed-off-by, etc).
> > >
> > >
> > > Ian Rogers (16):
> > > perf script: Fix metric_evlist leak in script_find_metrics
> > > perf stat: Fix evsel_list leak in cmd_stat
> > > perf tools: Fix sb_evlist leaks in top and record
> > > perf python: Fix memory leak in pyrf_evlist__get_pollfd
> > > perf synthetic-events: Fix uninitialized pthread_join
> > > perf data: Fix directory file descriptor leak in perf_data__switch
> > > perf test: Fix skiplist leak in cmd_test
> > > perf python: Check counts_values size in set_values
> > > perf python: Validate CPU and thread maps in pyrf_evsel__open
> > > perf python: Validate attribute setters in pyrf_evsel
> > > perf python: Zero initialize perf_data in pyrf_data__init
> > > perf python: Add thread and PMU uninitialized checks
> > > perf python: Fix MetricGroup return type in perf.pyi
> > > perf python: Fix count_values memory leak in pyrf_evsel__read
> > > perf python: Fix memory leak in pyrf__metrics_cb
> > > perf synthetic-events: Fix divide by zero in
> > > perf_event__synthesize_threads
> >
> > Will you send v3? You don't need to fix all pre-existing issues but we
> > should not introduce new bugs or regressions. I think some of Sashiko
> > comments found them like data switch and pmu init checks.
>
> Thanks Namhyung, I have a v3 coming. I'm working with Sashiko locally
> and trying to address as many issues as possible, including minor
> pre-existing ones—it's easier than remembering to clean them up later.
Sounds good. Looking forward to v3.
Thanks,
Namhyung
^ permalink raw reply [flat|nested] 74+ messages in thread
* [PATCH v3 00/15] perf python: Fix python extension bugs from v19 review
2026-06-24 5:15 ` [PATCH v2 00/16] perf python: Fix python extension bugs from v19 review Ian Rogers
` (17 preceding siblings ...)
2026-07-04 16:54 ` [PATCH v2 00/16] perf python: Fix python extension bugs from v19 review Namhyung Kim
@ 2026-08-09 7:14 ` Ian Rogers
2026-08-09 7:14 ` [PATCH v3 01/15] perf script: Fix metric_evlist leak in script_find_metrics Ian Rogers
` (14 more replies)
18 siblings, 15 replies; 74+ messages in thread
From: Ian Rogers @ 2026-08-09 7:14 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
Phase 1 of splitting the v19 review patches into smaller fixes.
These patches address issues identified in the python extension during
the review of the v19 script porting series, as well as fixing several
pre-existing bugs and leaks.
v3:
- Addressed review feedback from Namhyung Kim and Sashiko AI:
- Dropped "perf data: Fix directory file descriptor leak in perf_data__switch"
to avoid Use-After-Free during directory mode file rotation.
- Added list == NULL check in pyrf_counts_values_set_values to safely
handle attribute deletion (del obj.values).
- Preserved errno before calling intlist__delete(skiplist) in cmd_test
error path to prevent clobbering the return error code.
- Added CHECK_INITIALIZED to pyrf_pmu__repr to prevent NULL pointer
dereferences on uninitialized PMU objects.
- Fixed duplicate patch title from v2.
v2:
- Addressed sashiko review feedback:
- Fixed 64-bit casting for counts_values by using T_ULONGLONG and PyLong_FromUnsignedLongLong.
- Replaced strict Py_TYPE checks with PyObject_TypeCheck for thread/cpu maps.
- Fixed a missing CHECK_INITIALIZED for pyrf_thread__get_cpu, pyrf_pmu__name, pyrf_pmu__events.
- Included <string.h> where memset was used.
- Fixed line splitting formatting on PyObject_New in pyrf_evsel__read.
- Added fixes for memory leaks and issues discovered during review:
- Fix memory leak of key and value in pyrf__metrics_cb
- Fix count_values memory leak in pyrf_evsel__read
- Fix sb_evlist leaks in both top and record paths.
- Fix potential divide by zero in perf_event__synthesize_threads
v1:
- Decomposed the single large "Fix python extension bugs" patch into 13 individual fixes.
- Added Fixes: tags for issues that date back to earlier commits.
- Addressed checkpatch warnings (line lengths, Signed-off-by, etc).
Ian Rogers (15):
perf script: Fix metric_evlist leak in script_find_metrics
perf stat: Fix evsel_list leak in cmd_stat
perf tools: Fix sb_evlist leaks in top and record
perf python: Fix memory leak in pyrf_evlist__get_pollfd
perf synthetic-events: Fix uninitialized pthread_join
perf test: Fix skiplist leak in cmd_test
perf python: Check counts_values size in set_values
perf python: Validate CPU and thread maps in pyrf_evsel__open
perf python: Validate attribute setters in pyrf_evsel
perf python: Zero initialize perf_data in pyrf_data__init
perf python: Add thread and PMU uninitialized checks
perf python: Fix MetricGroup return type in perf.pyi
perf python: Fix count_values memory leak in pyrf_evsel__read
perf python: Fix memory leak in pyrf__metrics_cb
perf synthetic-events: Fix divide by zero in
perf_event__synthesize_threads
tools/perf/builtin-record.c | 2 +
tools/perf/builtin-script.c | 2 +-
tools/perf/builtin-stat.c | 9 +-
tools/perf/builtin-top.c | 2 +
tools/perf/python/perf.pyi | 4 +-
tools/perf/tests/builtin-test.c | 9 +-
tools/perf/util/python.c | 166 ++++++++++++++++++++++++-----
tools/perf/util/synthetic-events.c | 6 +-
8 files changed, 161 insertions(+), 39 deletions(-)
--
2.55.0.679.g6767b8d81c-goog
^ permalink raw reply [flat|nested] 74+ messages in thread* [PATCH v3 01/15] perf script: Fix metric_evlist leak in script_find_metrics
2026-08-09 7:14 ` [PATCH v3 00/15] " Ian Rogers
@ 2026-08-09 7:14 ` Ian Rogers
2026-08-09 7:37 ` sashiko-bot
2026-08-09 7:14 ` [PATCH v3 02/15] perf stat: Fix evsel_list leak in cmd_stat Ian Rogers
` (13 subsequent siblings)
14 siblings, 1 reply; 74+ messages in thread
From: Ian Rogers @ 2026-08-09 7:14 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
Fix a memory leak in script_find_metrics() where metric_evlist is leaked
when returning early on error paths.
Assisted-by: Antigravity:gemini-3.1-pro
Fixes: 3622990efaab ("perf script: Change metric format to use json metrics")
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/builtin-script.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
index f91d8b1fbd01..ad8ca08ceb5f 100644
--- a/tools/perf/builtin-script.c
+++ b/tools/perf/builtin-script.c
@@ -2276,8 +2276,8 @@ static int script_find_metrics(const struct pmu_metric *pm,
}
pr_debug("Found metric '%s' whose evsels match those of in the perf data\n",
pm->metric_name);
- evlist__put(metric_evlist);
out:
+ evlist__put(metric_evlist);
return 0;
}
--
2.55.0.679.g6767b8d81c-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* Re: [PATCH v3 01/15] perf script: Fix metric_evlist leak in script_find_metrics
2026-08-09 7:14 ` [PATCH v3 01/15] perf script: Fix metric_evlist leak in script_find_metrics Ian Rogers
@ 2026-08-09 7:37 ` sashiko-bot
0 siblings, 0 replies; 74+ messages in thread
From: sashiko-bot @ 2026-08-09 7:37 UTC (permalink / raw)
To: Ian Rogers; +Cc: linux-perf-users
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [High] Prematurely setting `metric_evsel->metric_id = NULL` breaks subsequent metric event lookups, null-terminating the `metric_events` array and dropping events.
--
--- Patch [1]: [PATCH v3 01/15] perf script: Fix metric_evlist leak in script_find_metrics ---
commit 5fba9e29ce353d01c2f25b3b58a05d2fc79eb299
Author: Ian Rogers <irogers@google.com>
perf script: Fix metric_evlist leak in script_find_metrics
Fix a memory leak in script_find_metrics() where metric_evlist is leaked
when returning early on error paths.
> diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
> --- a/tools/perf/builtin-script.c
> +++ b/tools/perf/builtin-script.c
[ ... ]
> evlist__for_each_entry(metric_evlist, metric_evsel) {
> struct evsel *script_evsel =
> map_metric_evsel_to_script_evsel(script_evlist, metric_evsel);
> struct metric_event *metric_me =
> metricgroup__lookup(evlist__metric_events(metric_evlist),
> metric_evsel,
> /*create=*/false);
>
> if (script_evsel->metric_id == NULL) {
> script_evsel->metric_id = metric_evsel->metric_id;
> metric_evsel->metric_id = NULL;
> }
[Severity: High]
This is a pre-existing issue, but could clearing metric_evsel->metric_id
here interfere with mapping resolutions later in this loop?
[ ... ]
> list_splice_init(&metric_me->head, &script_me->head);
> list_for_each_entry(expr, &script_me->head, nd) {
> for (int i = 0; expr->metric_events[i]; i++) {
> expr->metric_events[i] =
> map_metric_evsel_to_script_evsel(script_evlist,
> expr->metric_events[i]);
> }
> }
> }
> }
When map_metric_evsel_to_script_evsel() evaluates the required events,
would a NULL metric_id from the earlier transfer cause evsel__metric_id()
to return unknown?
It looks like this might fail the ID comparison against the script event
and return NULL, which would prematurely terminate the expr->metric_events
array and cause events to be silently dropped.
[ ... ]
> - evlist__put(metric_evlist);
> out:
> + evlist__put(metric_evlist);
> return 0;
> }
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260809071455.1221514-1-irogers@google.com?part=1
^ permalink raw reply [flat|nested] 74+ messages in thread
* [PATCH v3 02/15] perf stat: Fix evsel_list leak in cmd_stat
2026-08-09 7:14 ` [PATCH v3 00/15] " Ian Rogers
2026-08-09 7:14 ` [PATCH v3 01/15] perf script: Fix metric_evlist leak in script_find_metrics Ian Rogers
@ 2026-08-09 7:14 ` Ian Rogers
2026-08-09 7:14 ` [PATCH v3 03/15] perf tools: Fix sb_evlist leaks in top and record Ian Rogers
` (12 subsequent siblings)
14 siblings, 0 replies; 74+ messages in thread
From: Ian Rogers @ 2026-08-09 7:14 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
Fix a memory leak in cmd_stat() where evsel_list is leaked if an error
occurs while opening the output file.
Assisted-by: Antigravity:gemini-3.1-pro
Fixes: 361c99a661a7 ("perf evsel: Introduce perf_evlist")
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/builtin-stat.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index d68a2617a920..c50cf230f16e 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -2735,7 +2735,8 @@ int cmd_stat(int argc, const char **argv)
output = fopen(output_name, mode);
if (!output) {
perror("failed to create output file");
- return -1;
+ status = -1;
+ goto out;
}
if (!stat_config.json_output) {
clock_gettime(CLOCK_REALTIME, &tm);
@@ -2746,7 +2747,8 @@ int cmd_stat(int argc, const char **argv)
output = fdopen(output_fd, mode);
if (!output) {
perror("Failed opening logfd");
- return -errno;
+ status = -errno;
+ goto out;
}
}
@@ -2755,7 +2757,8 @@ int cmd_stat(int argc, const char **argv)
parse_options_usage(stat_usage, stat_options, "o", 1);
parse_options_usage(NULL, stat_options, "log-fd", 0);
parse_options_usage(NULL, stat_options, "interval-clear", 0);
- return -1;
+ status = -1;
+ goto out;
}
stat_config.output = output;
--
2.55.0.679.g6767b8d81c-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* [PATCH v3 03/15] perf tools: Fix sb_evlist leaks in top and record
2026-08-09 7:14 ` [PATCH v3 00/15] " Ian Rogers
2026-08-09 7:14 ` [PATCH v3 01/15] perf script: Fix metric_evlist leak in script_find_metrics Ian Rogers
2026-08-09 7:14 ` [PATCH v3 02/15] perf stat: Fix evsel_list leak in cmd_stat Ian Rogers
@ 2026-08-09 7:14 ` Ian Rogers
2026-08-09 7:14 ` [PATCH v3 04/15] perf python: Fix memory leak in pyrf_evlist__get_pollfd Ian Rogers
` (11 subsequent siblings)
14 siblings, 0 replies; 74+ messages in thread
From: Ian Rogers @ 2026-08-09 7:14 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
Fix a memory leak in cmd_top() where top.sb_evlist was not freed if
evlist__add_bpf_sb_event() fails. Note that evlist__start_sb_thread() and
evlist__stop_sb_thread() take ownership of the evlist and free it, so
we must only free it if we fail before starting the thread. Also set
top.sb_evlist to NULL to prevent use-after-free bugs.
Apply the same fix to builtin-record.c to avoid leaking rec->sb_evlist
and calling pthread_join on uninitialized threads in the error path.
Assisted-by: Antigravity:gemini-3.1-pro
Fixes: b38d85ef49cf ("perf bpf: Decouple creating the evlist from adding the SB event")
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/builtin-record.c | 2 ++
tools/perf/builtin-top.c | 2 ++
2 files changed, 4 insertions(+)
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index f58d7e3c7879..a57987851cf0 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -2258,6 +2258,8 @@ static int record__setup_sb_evlist(struct record *rec)
if (evlist__add_bpf_sb_event(rec->sb_evlist, perf_session__env(rec->session))) {
pr_err("Couldn't ask for PERF_RECORD_BPF_EVENT side band events.\n.");
+ evlist__put(rec->sb_evlist);
+ rec->sb_evlist = NULL;
return -1;
}
}
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index 5933c46ee137..570410599f1b 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -1881,6 +1881,8 @@ int cmd_top(int argc, const char **argv)
if (evlist__add_bpf_sb_event(top.sb_evlist, &host_env)) {
pr_err("Couldn't ask for PERF_RECORD_BPF_EVENT side band events.\n.");
status = -EINVAL;
+ evlist__put(top.sb_evlist);
+ top.sb_evlist = NULL;
goto out_put_evlist;
}
}
--
2.55.0.679.g6767b8d81c-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* [PATCH v3 04/15] perf python: Fix memory leak in pyrf_evlist__get_pollfd
2026-08-09 7:14 ` [PATCH v3 00/15] " Ian Rogers
` (2 preceding siblings ...)
2026-08-09 7:14 ` [PATCH v3 03/15] perf tools: Fix sb_evlist leaks in top and record Ian Rogers
@ 2026-08-09 7:14 ` Ian Rogers
2026-08-09 7:33 ` sashiko-bot
2026-08-09 7:14 ` [PATCH v3 05/15] perf synthetic-events: Fix uninitialized pthread_join Ian Rogers
` (10 subsequent siblings)
14 siblings, 1 reply; 74+ messages in thread
From: Ian Rogers @ 2026-08-09 7:14 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
Fix a Python list object leak in pyrf_evlist__get_pollfd() by adding
a missing Py_DECREF on the error exit path.
Assisted-by: Antigravity:gemini-3.1-pro
Fixes: 877108e42b1b ("perf tools: Initial python binding")
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/util/python.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index af85c0771c44..c7ae1f85aec6 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -2825,6 +2825,8 @@ static PyObject *pyrf_evlist__get_pollfd(struct pyrf_evlist *pevlist,
evlist = pevlist->evlist;
list = PyList_New(0);
+ if (!list)
+ return NULL;
for (i = 0; i < evlist__core(evlist)->pollfd.nr; ++i) {
PyObject *file;
@@ -2843,6 +2845,7 @@ static PyObject *pyrf_evlist__get_pollfd(struct pyrf_evlist *pevlist,
return list;
free_list:
+ Py_XDECREF(list);
return PyErr_NoMemory();
}
--
2.55.0.679.g6767b8d81c-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* Re: [PATCH v3 04/15] perf python: Fix memory leak in pyrf_evlist__get_pollfd
2026-08-09 7:14 ` [PATCH v3 04/15] perf python: Fix memory leak in pyrf_evlist__get_pollfd Ian Rogers
@ 2026-08-09 7:33 ` sashiko-bot
0 siblings, 0 replies; 74+ messages in thread
From: sashiko-bot @ 2026-08-09 7:33 UTC (permalink / raw)
To: Ian Rogers; +Cc: linux-perf-users
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but missing NULL check on the return value of `PyLong_FromLong` in `pyrf_counts_values_get_values` leads to a crash.
- [High] This problem wasn't introduced by this patch, but there is a memory leak of `key` and `value` objects on the success path of `PyDict_SetItem` in `pyrf__metrics_cb`.
--
--- Patch [4]: [PATCH v3 04/15] perf python: Fix memory leak in pyrf_evlist__get_pollfd ---
commit 4d7f49a1892b79c6131283be18ebf7cc1b0fd24f
Author: Ian Rogers <irogers@google.com>
perf python: Fix memory leak in pyrf_evlist__get_pollfd
This patch fixes a Python list object leak in pyrf_evlist__get_pollfd() by
adding a missing Py_DECREF on an error exit path. It also adds a check
for list allocation failure.
Assisted-by: Antigravity:gemini-3.1-pro
Fixes: 877108e42b1b ("perf tools: Initial python binding")
Signed-off-by: Ian Rogers <irogers@google.com>
> diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
> index af85c0771c448..c7ae1f85aec6d 100644
> --- a/tools/perf/util/python.c
> +++ b/tools/perf/util/python.c
> @@ -2825,6 +2825,8 @@ static PyObject *pyrf_evlist__get_pollfd(struct pyrf_evlist *pevlist,
>
> evlist = pevlist->evlist;
> list = PyList_New(0);
> + if (!list)
> + return NULL;
>
> for (i = 0; i < evlist__core(evlist)->pollfd.nr; ++i) {
> PyObject *file;
> @@ -2843,6 +2845,7 @@ static PyObject *pyrf_evlist__get_pollfd(struct pyrf_evlist *pevlist,
>
> return list;
> free_list:
> + Py_XDECREF(list);
> return PyErr_NoMemory();
> }
[Severity: High]
This isn't a bug introduced by this patch, but I noticed a potential crash
here in pyrf_counts_values_get_values() when memory is exhausted:
tools/perf/util/python.c:pyrf_counts_values_get_values() {
...
PyObject *vals = PyList_New(5);
if (!vals)
return NULL;
for (int i = 0; i < 5; i++)
PyList_SetItem(vals, i, PyLong_FromLong(self->values.values[i]));
return vals;
}
Can PyLong_FromLong() return a null pointer during memory pressure?
If so, PyList_SetItem() will place the null pointer directly into the list's
internal array without validation.
Could this cause operations like PyObject_Repr to later dereference the
pointer and crash the Python interpreter abruptly instead of raising a
MemoryError?
[Severity: High]
This is a pre-existing issue, but there appears to be a memory leak in
pyrf__metrics_cb():
tools/perf/util/python.c:pyrf__metrics_cb() {
...
PyObject *key = dict ? PyUnicode_FromString("MetricGroup") : NULL;
PyObject *value = key ? pyrf__metrics_groups(pm) : NULL;
if (!value || PyDict_SetItem(dict, key, value) != 0) {
Py_XDECREF(key);
Py_XDECREF(value);
Py_XDECREF(dict);
return -ENOMEM;
}
if (!add_to_dict(dict, "MetricName", pm->metric_name) ||
...
}
Does the success path of PyDict_SetItem leak the key and value objects?
The error path correctly drops the references, but if PyDict_SetItem
succeeds, it does not steal the references.
Since this function is called as a callback in pmu_for_each_sys_metric(),
will this unconditionally leak both objects for every valid system metric
processed?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260809071455.1221514-1-irogers@google.com?part=4
^ permalink raw reply [flat|nested] 74+ messages in thread
* [PATCH v3 05/15] perf synthetic-events: Fix uninitialized pthread_join
2026-08-09 7:14 ` [PATCH v3 00/15] " Ian Rogers
` (3 preceding siblings ...)
2026-08-09 7:14 ` [PATCH v3 04/15] perf python: Fix memory leak in pyrf_evlist__get_pollfd Ian Rogers
@ 2026-08-09 7:14 ` Ian Rogers
2026-08-09 7:14 ` [PATCH v3 06/15] perf test: Fix skiplist leak in cmd_test Ian Rogers
` (9 subsequent siblings)
14 siblings, 0 replies; 74+ messages in thread
From: Ian Rogers @ 2026-08-09 7:14 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
In perf_event__synthesize_threads(), fix an uninitialized pthread_join()
call when thread creation fails by only joining the successfully
created threads.
Assisted-by: Antigravity:gemini-3.1-pro
Fixes: 340b47f510bb ("perf top: Implement multithreading for perf_event__synthesize_threads")
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/util/synthetic-events.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic-events.c
index 75a32ae8ef62..3583a60cc487 100644
--- a/tools/perf/util/synthetic-events.c
+++ b/tools/perf/util/synthetic-events.c
@@ -1221,8 +1221,8 @@ int perf_event__synthesize_threads(const struct perf_tool *tool,
}
err = 0;
out_join:
- for (i = 0; i < thread_nr; i++)
- pthread_join(synthesize_threads[i], NULL);
+ for (j = 0; j < i; j++)
+ pthread_join(synthesize_threads[j], NULL);
free(args);
free_threads:
free(synthesize_threads);
--
2.55.0.679.g6767b8d81c-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* [PATCH v3 06/15] perf test: Fix skiplist leak in cmd_test
2026-08-09 7:14 ` [PATCH v3 00/15] " Ian Rogers
` (4 preceding siblings ...)
2026-08-09 7:14 ` [PATCH v3 05/15] perf synthetic-events: Fix uninitialized pthread_join Ian Rogers
@ 2026-08-09 7:14 ` Ian Rogers
2026-08-09 7:14 ` [PATCH v3 07/15] perf python: Check counts_values size in set_values Ian Rogers
` (8 subsequent siblings)
14 siblings, 0 replies; 74+ messages in thread
From: Ian Rogers @ 2026-08-09 7:14 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
Fix a memory leak in cmd_test() where skiplist was not freed on
exit paths.
Assisted-by: Antigravity:gemini-3.1-pro
Fixes: 2ae828786c65 ("perf test: Allow skipping tests")
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/tests/builtin-test.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/tools/perf/tests/builtin-test.c b/tools/perf/tests/builtin-test.c
index 41dcfbf874f0..4d0784b16723 100644
--- a/tools/perf/tests/builtin-test.c
+++ b/tools/perf/tests/builtin-test.c
@@ -1802,9 +1802,14 @@ int cmd_test(int argc, const char **argv)
rlimit__bump_memlock();
suites = build_suites();
- if (!suites)
- return errno ? -errno : -ENOMEM;
+ if (!suites) {
+ int err = errno;
+
+ intlist__delete(skiplist);
+ return err ? -err : -ENOMEM;
+ }
ret = __cmd_test(suites, argc, argv, skiplist);
free(suites);
+ intlist__delete(skiplist);
return ret;
}
--
2.55.0.679.g6767b8d81c-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* [PATCH v3 07/15] perf python: Check counts_values size in set_values
2026-08-09 7:14 ` [PATCH v3 00/15] " Ian Rogers
` (5 preceding siblings ...)
2026-08-09 7:14 ` [PATCH v3 06/15] perf test: Fix skiplist leak in cmd_test Ian Rogers
@ 2026-08-09 7:14 ` Ian Rogers
2026-08-09 7:14 ` [PATCH v3 08/15] perf python: Validate CPU and thread maps in pyrf_evsel__open Ian Rogers
` (7 subsequent siblings)
14 siblings, 0 replies; 74+ messages in thread
From: Ian Rogers @ 2026-08-09 7:14 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
The set_values function incorrectly assumed the list contained exactly
5 elements. Add a check to prevent out-of-bounds access.
Fixes: 877108e42b1b ("perf tools: Initial python binding")
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/util/python.c | 38 ++++++++++++++++++++++++++++++--------
1 file changed, 30 insertions(+), 8 deletions(-)
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index c7ae1f85aec6..f64d662bd3ee 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -1881,11 +1881,11 @@ static void pyrf_counts_values__delete(struct pyrf_counts_values *pcounts_values
0, help }
static PyMemberDef pyrf_counts_values_members[] = {
- counts_values_member_def(val, T_ULONG, "Value of event"),
- counts_values_member_def(ena, T_ULONG, "Time for which enabled"),
- counts_values_member_def(run, T_ULONG, "Time for which running"),
- counts_values_member_def(id, T_ULONG, "Unique ID for an event"),
- counts_values_member_def(lost, T_ULONG, "Num of lost samples"),
+ counts_values_member_def(val, T_ULONGLONG, "Value of event"),
+ counts_values_member_def(ena, T_ULONGLONG, "Time for which enabled"),
+ counts_values_member_def(run, T_ULONGLONG, "Time for which running"),
+ counts_values_member_def(id, T_ULONGLONG, "Unique ID for an event"),
+ counts_values_member_def(lost, T_ULONGLONG, "Num of lost samples"),
{ .name = NULL, },
};
@@ -1895,8 +1895,15 @@ static PyObject *pyrf_counts_values_get_values(struct pyrf_counts_values *self,
if (!vals)
return NULL;
- for (int i = 0; i < 5; i++)
- PyList_SetItem(vals, i, PyLong_FromLong(self->values.values[i]));
+ for (int i = 0; i < 5; i++) {
+ PyObject *val = PyLong_FromUnsignedLongLong(self->values.values[i]);
+
+ if (!val) {
+ Py_DECREF(vals);
+ return NULL;
+ }
+ PyList_SetItem(vals, i, val);
+ }
return vals;
}
@@ -1907,19 +1914,34 @@ static int pyrf_counts_values_set_values(struct pyrf_counts_values *self, PyObje
Py_ssize_t size;
PyObject *item = NULL;
+ if (list == NULL) {
+ PyErr_SetString(PyExc_TypeError, "cannot delete attribute");
+ return -1;
+ }
+
if (!PyList_Check(list)) {
PyErr_SetString(PyExc_TypeError, "Value assigned must be a list");
return -1;
}
size = PyList_Size(list);
+ if (size != 5) {
+ PyErr_SetString(PyExc_ValueError, "List must have exactly 5 entries");
+ return -1;
+ }
+
for (Py_ssize_t i = 0; i < size; i++) {
+ unsigned long long val;
+
item = PyList_GetItem(list, i);
if (!PyLong_Check(item)) {
PyErr_SetString(PyExc_TypeError, "List members should be numbers");
return -1;
}
- self->values.values[i] = PyLong_AsLong(item);
+ val = PyLong_AsUnsignedLongLong(item);
+ if (val == (unsigned long long)-1 && PyErr_Occurred())
+ return -1;
+ self->values.values[i] = val;
}
return 0;
--
2.55.0.679.g6767b8d81c-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* [PATCH v3 08/15] perf python: Validate CPU and thread maps in pyrf_evsel__open
2026-08-09 7:14 ` [PATCH v3 00/15] " Ian Rogers
` (6 preceding siblings ...)
2026-08-09 7:14 ` [PATCH v3 07/15] perf python: Check counts_values size in set_values Ian Rogers
@ 2026-08-09 7:14 ` Ian Rogers
2026-08-09 7:14 ` [PATCH v3 09/15] perf python: Validate attribute setters in pyrf_evsel Ian Rogers
` (6 subsequent siblings)
14 siblings, 0 replies; 74+ messages in thread
From: Ian Rogers @ 2026-08-09 7:14 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
Add explicit Py_TYPE checks to ensure the arguments passed are
actually of the correct pyrf_thread_map and pyrf_cpu_map types.
Fixes: 877108e42b1b ("perf tools: Initial python binding")
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/util/python.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index f64d662bd3ee..a1334400874c 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -2113,11 +2113,21 @@ static PyObject *pyrf_evsel__open(struct pyrf_evsel *pevsel,
&pcpus, &pthreads, &group, &inherit))
return NULL;
- if (pthreads != NULL && pthreads != Py_None)
+ if (pthreads != NULL && pthreads != Py_None) {
+ if (!PyObject_TypeCheck(pthreads, &pyrf_thread_map__type)) {
+ PyErr_SetString(PyExc_TypeError, "threads must be a thread_map");
+ return NULL;
+ }
threads = ((struct pyrf_thread_map *)pthreads)->threads;
+ }
- if (pcpus != NULL && pcpus != Py_None)
+ if (pcpus != NULL && pcpus != Py_None) {
+ if (!PyObject_TypeCheck(pcpus, &pyrf_cpu_map__type)) {
+ PyErr_SetString(PyExc_TypeError, "cpus must be a cpu_map");
+ return NULL;
+ }
cpus = ((struct pyrf_cpu_map *)pcpus)->cpus;
+ }
evsel->core.attr.inherit = inherit;
/*
--
2.55.0.679.g6767b8d81c-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* [PATCH v3 09/15] perf python: Validate attribute setters in pyrf_evsel
2026-08-09 7:14 ` [PATCH v3 00/15] " Ian Rogers
` (7 preceding siblings ...)
2026-08-09 7:14 ` [PATCH v3 08/15] perf python: Validate CPU and thread maps in pyrf_evsel__open Ian Rogers
@ 2026-08-09 7:14 ` Ian Rogers
2026-08-09 7:14 ` [PATCH v3 10/15] perf python: Zero initialize perf_data in pyrf_data__init Ian Rogers
` (5 subsequent siblings)
14 siblings, 0 replies; 74+ messages in thread
From: Ian Rogers @ 2026-08-09 7:14 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
If val is NULL when setting an attribute, PyErr_SetString should be
called as deleting the attribute isn't supported. In addition, ensure
PyErr_Occurred is checked before setting the attribute to avoid setting
a garbage value.
Fixes: 877108e42b1b ("perf tools: Initial python binding")
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/util/python.c | 89 ++++++++++++++++++++++++++++++++++------
1 file changed, 77 insertions(+), 12 deletions(-)
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index a1334400874c..848912401c4f 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -2301,6 +2301,11 @@ static int pyrf_evsel__set_tracking(PyObject *self, PyObject *val, void *closure
CHECK_INITIALIZED_INT(pevsel->evsel, "evsel");
+ if (val == NULL) {
+ PyErr_SetString(PyExc_TypeError, "cannot delete attribute");
+ return -1;
+ }
+
is_true = PyObject_IsTrue(val);
if (is_true < 0)
return -1;
@@ -2312,11 +2317,21 @@ static int pyrf_evsel__set_tracking(PyObject *self, PyObject *val, void *closure
static int pyrf_evsel__set_attr_config(PyObject *self, PyObject *val, void *closure __maybe_unused)
{
struct pyrf_evsel *pevsel = (void *)self;
+ unsigned long long new_val;
CHECK_INITIALIZED_INT(pevsel->evsel, "evsel");
- pevsel->evsel->core.attr.config = PyLong_AsUnsignedLongLong(val);
- return PyErr_Occurred() ? -1 : 0;
+ if (val == NULL) {
+ PyErr_SetString(PyExc_TypeError, "cannot delete attribute");
+ return -1;
+ }
+
+ new_val = PyLong_AsUnsignedLongLong(val);
+ if (PyErr_Occurred())
+ return -1;
+
+ pevsel->evsel->core.attr.config = new_val;
+ return 0;
}
static PyObject *pyrf_evsel__get_attr_config(PyObject *self, void *closure __maybe_unused)
@@ -2331,11 +2346,21 @@ static PyObject *pyrf_evsel__get_attr_config(PyObject *self, void *closure __may
static int pyrf_evsel__set_attr_read_format(PyObject *self, PyObject *val, void *closure __maybe_unused)
{
struct pyrf_evsel *pevsel = (void *)self;
+ unsigned long long new_val;
CHECK_INITIALIZED_INT(pevsel->evsel, "evsel");
- pevsel->evsel->core.attr.read_format = PyLong_AsUnsignedLongLong(val);
- return PyErr_Occurred() ? -1 : 0;
+ if (val == NULL) {
+ PyErr_SetString(PyExc_TypeError, "cannot delete attribute");
+ return -1;
+ }
+
+ new_val = PyLong_AsUnsignedLongLong(val);
+ if (PyErr_Occurred())
+ return -1;
+
+ pevsel->evsel->core.attr.read_format = new_val;
+ return 0;
}
static PyObject *pyrf_evsel__get_attr_read_format(PyObject *self, void *closure __maybe_unused)
@@ -2350,11 +2375,21 @@ static PyObject *pyrf_evsel__get_attr_read_format(PyObject *self, void *closure
static int pyrf_evsel__set_attr_sample_period(PyObject *self, PyObject *val, void *closure __maybe_unused)
{
struct pyrf_evsel *pevsel = (void *)self;
+ unsigned long long new_val;
CHECK_INITIALIZED_INT(pevsel->evsel, "evsel");
- pevsel->evsel->core.attr.sample_period = PyLong_AsUnsignedLongLong(val);
- return PyErr_Occurred() ? -1 : 0;
+ if (val == NULL) {
+ PyErr_SetString(PyExc_TypeError, "cannot delete attribute");
+ return -1;
+ }
+
+ new_val = PyLong_AsUnsignedLongLong(val);
+ if (PyErr_Occurred())
+ return -1;
+
+ pevsel->evsel->core.attr.sample_period = new_val;
+ return 0;
}
static PyObject *pyrf_evsel__get_attr_sample_period(PyObject *self, void *closure __maybe_unused)
@@ -2369,11 +2404,21 @@ static PyObject *pyrf_evsel__get_attr_sample_period(PyObject *self, void *closur
static int pyrf_evsel__set_attr_sample_type(PyObject *self, PyObject *val, void *closure __maybe_unused)
{
struct pyrf_evsel *pevsel = (void *)self;
+ unsigned long long new_val;
CHECK_INITIALIZED_INT(pevsel->evsel, "evsel");
- pevsel->evsel->core.attr.sample_type = PyLong_AsUnsignedLongLong(val);
- return PyErr_Occurred() ? -1 : 0;
+ if (val == NULL) {
+ PyErr_SetString(PyExc_TypeError, "cannot delete attribute");
+ return -1;
+ }
+
+ new_val = PyLong_AsUnsignedLongLong(val);
+ if (PyErr_Occurred())
+ return -1;
+
+ pevsel->evsel->core.attr.sample_type = new_val;
+ return 0;
}
static PyObject *pyrf_evsel__get_attr_sample_type(PyObject *self, void *closure __maybe_unused)
@@ -2397,11 +2442,21 @@ static PyObject *pyrf_evsel__get_attr_size(PyObject *self, void *closure __maybe
static int pyrf_evsel__set_attr_type(PyObject *self, PyObject *val, void *closure __maybe_unused)
{
struct pyrf_evsel *pevsel = (void *)self;
+ unsigned long new_val;
CHECK_INITIALIZED_INT(pevsel->evsel, "evsel");
- pevsel->evsel->core.attr.type = PyLong_AsUnsignedLong(val);
- return PyErr_Occurred() ? -1 : 0;
+ if (val == NULL) {
+ PyErr_SetString(PyExc_TypeError, "cannot delete attribute");
+ return -1;
+ }
+
+ new_val = PyLong_AsUnsignedLong(val);
+ if (PyErr_Occurred())
+ return -1;
+
+ pevsel->evsel->core.attr.type = new_val;
+ return 0;
}
static PyObject *pyrf_evsel__get_attr_type(PyObject *self, void *closure __maybe_unused)
@@ -2416,11 +2471,21 @@ static PyObject *pyrf_evsel__get_attr_type(PyObject *self, void *closure __maybe
static int pyrf_evsel__set_attr_wakeup_events(PyObject *self, PyObject *val, void *closure __maybe_unused)
{
struct pyrf_evsel *pevsel = (void *)self;
+ unsigned long new_val;
CHECK_INITIALIZED_INT(pevsel->evsel, "evsel");
- pevsel->evsel->core.attr.wakeup_events = PyLong_AsUnsignedLong(val);
- return PyErr_Occurred() ? -1 : 0;
+ if (val == NULL) {
+ PyErr_SetString(PyExc_TypeError, "cannot delete attribute");
+ return -1;
+ }
+
+ new_val = PyLong_AsUnsignedLong(val);
+ if (PyErr_Occurred())
+ return -1;
+
+ pevsel->evsel->core.attr.wakeup_events = new_val;
+ return 0;
}
static PyObject *pyrf_evsel__get_attr_wakeup_events(PyObject *self, void *closure __maybe_unused)
--
2.55.0.679.g6767b8d81c-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* [PATCH v3 10/15] perf python: Zero initialize perf_data in pyrf_data__init
2026-08-09 7:14 ` [PATCH v3 00/15] " Ian Rogers
` (8 preceding siblings ...)
2026-08-09 7:14 ` [PATCH v3 09/15] perf python: Validate attribute setters in pyrf_evsel Ian Rogers
@ 2026-08-09 7:14 ` Ian Rogers
2026-08-09 7:14 ` [PATCH v3 11/15] perf python: Add thread and PMU uninitialized checks Ian Rogers
` (4 subsequent siblings)
14 siblings, 0 replies; 74+ messages in thread
From: Ian Rogers @ 2026-08-09 7:14 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
Replace path clearing with memset so the entire struct is zeroed,
preventing uninitialized fields from causing errors later.
Fixes: 4cd0142f7dec ("perf python: Add wrapper for perf_data file abstraction")
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/util/python.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index 848912401c4f..c70b151428f7 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -3,6 +3,7 @@
#include <Python.h>
#include <inttypes.h>
+#include <string.h>
#include <linux/err.h>
#include <poll.h>
@@ -3627,7 +3628,7 @@ static int pyrf_data__init(struct pyrf_data *pdata, PyObject *args, PyObject *kw
if (pdata->data.open)
perf_data__close(&pdata->data);
free((char *)pdata->data.path);
- pdata->data.path = NULL;
+ memset(&pdata->data, 0, sizeof(pdata->data));
if (fd != -1) {
struct stat st;
--
2.55.0.679.g6767b8d81c-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* [PATCH v3 11/15] perf python: Add thread and PMU uninitialized checks
2026-08-09 7:14 ` [PATCH v3 00/15] " Ian Rogers
` (9 preceding siblings ...)
2026-08-09 7:14 ` [PATCH v3 10/15] perf python: Zero initialize perf_data in pyrf_data__init Ian Rogers
@ 2026-08-09 7:14 ` Ian Rogers
2026-08-09 7:28 ` sashiko-bot
2026-08-09 7:14 ` [PATCH v3 12/15] perf python: Fix MetricGroup return type in perf.pyi Ian Rogers
` (3 subsequent siblings)
14 siblings, 1 reply; 74+ messages in thread
From: Ian Rogers @ 2026-08-09 7:14 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
Add CHECK_INITIALIZED checks to the thread attribute getters
(get_pid, get_tid, get_ppid) to prevent crashes if they are accessed
before being properly initialized.
Fixes: 3b96bf7af60d ("perf python: Add python session abstraction wrapping perf's session")
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/util/python.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index c70b151428f7..fe5afce17333 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -1678,6 +1678,7 @@ static PyObject *pyrf_pmu__name(PyObject *self)
{
struct pyrf_pmu *ppmu = (void *)self;
+ CHECK_INITIALIZED(ppmu->pmu, "pmu");
return PyUnicode_FromString(ppmu->pmu->name);
}
@@ -1730,6 +1731,8 @@ static PyObject *pyrf_pmu__events(PyObject *self)
PyObject *py_list = PyList_New(0);
int ret;
+ CHECK_INITIALIZED(ppmu->pmu, "pmu");
+
if (!py_list)
return NULL;
@@ -1750,6 +1753,7 @@ static PyObject *pyrf_pmu__repr(PyObject *self)
{
struct pyrf_pmu *ppmu = (void *)self;
+ CHECK_INITIALIZED(ppmu->pmu, "pmu");
return PyUnicode_FromFormat("pmu(%s)", ppmu->pmu->name);
}
@@ -3764,21 +3768,25 @@ static PyMethodDef pyrf_thread__methods[] = {
static PyObject *pyrf_thread__get_pid(struct pyrf_thread *pthread, void *closure __maybe_unused)
{
+ CHECK_INITIALIZED(pthread->thread, "thread");
return PyLong_FromLong(thread__pid(pthread->thread));
}
static PyObject *pyrf_thread__get_tid(struct pyrf_thread *pthread, void *closure __maybe_unused)
{
+ CHECK_INITIALIZED(pthread->thread, "thread");
return PyLong_FromLong(thread__tid(pthread->thread));
}
static PyObject *pyrf_thread__get_ppid(struct pyrf_thread *pthread, void *closure __maybe_unused)
{
+ CHECK_INITIALIZED(pthread->thread, "thread");
return PyLong_FromLong(thread__ppid(pthread->thread));
}
static PyObject *pyrf_thread__get_cpu(struct pyrf_thread *pthread, void *closure __maybe_unused)
{
+ CHECK_INITIALIZED(pthread->thread, "thread");
return PyLong_FromLong(thread__cpu(pthread->thread));
}
--
2.55.0.679.g6767b8d81c-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* Re: [PATCH v3 11/15] perf python: Add thread and PMU uninitialized checks
2026-08-09 7:14 ` [PATCH v3 11/15] perf python: Add thread and PMU uninitialized checks Ian Rogers
@ 2026-08-09 7:28 ` sashiko-bot
2026-08-10 5:02 ` Namhyung Kim
0 siblings, 1 reply; 74+ messages in thread
From: sashiko-bot @ 2026-08-09 7:28 UTC (permalink / raw)
To: Ian Rogers; +Cc: linux-perf-users
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The newly added `CHECK_INITIALIZED(ppmu->pmu, "pmu")` in `pyrf_pmu__events()` causes a Python object memory leak of `py_list` on the error path.
--
--- Patch [11]: [PATCH v3 11/15] perf python: Add thread and PMU uninitialized checks ---
commit a381b82bb0eb00b93be525bfa1c265b574c03a5a
Author: Ian Rogers <irogers@google.com>
perf python: Add thread and PMU uninitialized checks
This commit adds CHECK_INITIALIZED guards to thread and PMU getters to
prevent crashes when accessed before proper initialization.
> diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
> index c70b151428f76..fe5afce173330 100644
> --- a/tools/perf/util/python.c
> +++ b/tools/perf/util/python.c
[ ... ]
> @@ -1730,6 +1731,8 @@ static PyObject *pyrf_pmu__events(PyObject *self)
> PyObject *py_list = PyList_New(0);
> int ret;
>
> + CHECK_INITIALIZED(ppmu->pmu, "pmu");
> +
> if (!py_list)
> return NULL;
[Severity: Medium]
Does this code leak py_list if CHECK_INITIALIZED fails and returns early?
Since py_list is allocated with PyList_New(0) just before the initialization
check, it appears this Python object is left orphaned if the macro evaluates
to true and forces an early return.
Could the CHECK_INITIALIZED macro be moved to the beginning of
pyrf_pmu__events() before the PyList_New(0) allocation to avoid this leak?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260809071455.1221514-1-irogers@google.com?part=11
^ permalink raw reply [flat|nested] 74+ messages in thread
* Re: [PATCH v3 11/15] perf python: Add thread and PMU uninitialized checks
2026-08-09 7:28 ` sashiko-bot
@ 2026-08-10 5:02 ` Namhyung Kim
2026-08-10 5:41 ` Ian Rogers
0 siblings, 1 reply; 74+ messages in thread
From: Namhyung Kim @ 2026-08-10 5:02 UTC (permalink / raw)
To: sashiko-reviews; +Cc: Ian Rogers, linux-perf-users
Hello,
On Sun, Aug 09, 2026 at 07:28:09AM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] The newly added `CHECK_INITIALIZED(ppmu->pmu, "pmu")` in `pyrf_pmu__events()` causes a Python object memory leak of `py_list` on the error path.
> --
>
> --- Patch [11]: [PATCH v3 11/15] perf python: Add thread and PMU uninitialized checks ---
> commit a381b82bb0eb00b93be525bfa1c265b574c03a5a
> Author: Ian Rogers <irogers@google.com>
>
> perf python: Add thread and PMU uninitialized checks
>
> This commit adds CHECK_INITIALIZED guards to thread and PMU getters to
> prevent crashes when accessed before proper initialization.
>
> > diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
> > index c70b151428f76..fe5afce173330 100644
> > --- a/tools/perf/util/python.c
> > +++ b/tools/perf/util/python.c
>
> [ ... ]
>
> > @@ -1730,6 +1731,8 @@ static PyObject *pyrf_pmu__events(PyObject *self)
> > PyObject *py_list = PyList_New(0);
> > int ret;
> >
> > + CHECK_INITIALIZED(ppmu->pmu, "pmu");
> > +
> > if (!py_list)
> > return NULL;
>
> [Severity: Medium]
> Does this code leak py_list if CHECK_INITIALIZED fails and returns early?
>
> Since py_list is allocated with PyList_New(0) just before the initialization
> check, it appears this Python object is left orphaned if the macro evaluates
> to true and forces an early return.
>
> Could the CHECK_INITIALIZED macro be moved to the beginning of
> pyrf_pmu__events() before the PyList_New(0) allocation to avoid this leak?
It seems this is the only issue introduced in this series.
As it's trivial, I'll apply the following change for Ian.
Thanks,
Namhyung
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index fe5afce1733306be..36c5f4b0d0bb15e7 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -1728,11 +1728,12 @@ static int pyrf_pmu__events_cb(void *state, struct pmu_event_info *info)
static PyObject *pyrf_pmu__events(PyObject *self)
{
struct pyrf_pmu *ppmu = (void *)self;
- PyObject *py_list = PyList_New(0);
+ PyObject *py_list;
int ret;
CHECK_INITIALIZED(ppmu->pmu, "pmu");
+ py_list = PyList_New(0);
if (!py_list)
return NULL;
^ permalink raw reply related [flat|nested] 74+ messages in thread* Re: [PATCH v3 11/15] perf python: Add thread and PMU uninitialized checks
2026-08-10 5:02 ` Namhyung Kim
@ 2026-08-10 5:41 ` Ian Rogers
0 siblings, 0 replies; 74+ messages in thread
From: Ian Rogers @ 2026-08-10 5:41 UTC (permalink / raw)
To: Namhyung Kim; +Cc: sashiko-reviews, linux-perf-users
On Sun, Aug 9, 2026 at 10:02 PM Namhyung Kim <namhyung@kernel.org> wrote:
>
> Hello,
>
> On Sun, Aug 09, 2026 at 07:28:09AM +0000, sashiko-bot@kernel.org wrote:
> > Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> > - [Medium] The newly added `CHECK_INITIALIZED(ppmu->pmu, "pmu")` in `pyrf_pmu__events()` causes a Python object memory leak of `py_list` on the error path.
> > --
> >
> > --- Patch [11]: [PATCH v3 11/15] perf python: Add thread and PMU uninitialized checks ---
> > commit a381b82bb0eb00b93be525bfa1c265b574c03a5a
> > Author: Ian Rogers <irogers@google.com>
> >
> > perf python: Add thread and PMU uninitialized checks
> >
> > This commit adds CHECK_INITIALIZED guards to thread and PMU getters to
> > prevent crashes when accessed before proper initialization.
> >
> > > diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
> > > index c70b151428f76..fe5afce173330 100644
> > > --- a/tools/perf/util/python.c
> > > +++ b/tools/perf/util/python.c
> >
> > [ ... ]
> >
> > > @@ -1730,6 +1731,8 @@ static PyObject *pyrf_pmu__events(PyObject *self)
> > > PyObject *py_list = PyList_New(0);
> > > int ret;
> > >
> > > + CHECK_INITIALIZED(ppmu->pmu, "pmu");
> > > +
> > > if (!py_list)
> > > return NULL;
> >
> > [Severity: Medium]
> > Does this code leak py_list if CHECK_INITIALIZED fails and returns early?
> >
> > Since py_list is allocated with PyList_New(0) just before the initialization
> > check, it appears this Python object is left orphaned if the macro evaluates
> > to true and forces an early return.
> >
> > Could the CHECK_INITIALIZED macro be moved to the beginning of
> > pyrf_pmu__events() before the PyList_New(0) allocation to avoid this leak?
>
> It seems this is the only issue introduced in this series.
> As it's trivial, I'll apply the following change for Ian.
Looks good to me. Thanks,
Ian
> Thanks,
> Namhyung
>
>
> diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
> index fe5afce1733306be..36c5f4b0d0bb15e7 100644
> --- a/tools/perf/util/python.c
> +++ b/tools/perf/util/python.c
> @@ -1728,11 +1728,12 @@ static int pyrf_pmu__events_cb(void *state, struct pmu_event_info *info)
> static PyObject *pyrf_pmu__events(PyObject *self)
> {
> struct pyrf_pmu *ppmu = (void *)self;
> - PyObject *py_list = PyList_New(0);
> + PyObject *py_list;
> int ret;
>
> CHECK_INITIALIZED(ppmu->pmu, "pmu");
>
> + py_list = PyList_New(0);
> if (!py_list)
> return NULL;
>
>
^ permalink raw reply [flat|nested] 74+ messages in thread
* [PATCH v3 12/15] perf python: Fix MetricGroup return type in perf.pyi
2026-08-09 7:14 ` [PATCH v3 00/15] " Ian Rogers
` (10 preceding siblings ...)
2026-08-09 7:14 ` [PATCH v3 11/15] perf python: Add thread and PMU uninitialized checks Ian Rogers
@ 2026-08-09 7:14 ` Ian Rogers
2026-08-09 7:27 ` sashiko-bot
2026-08-09 7:14 ` [PATCH v3 13/15] perf python: Fix count_values memory leak in pyrf_evsel__read Ian Rogers
` (2 subsequent siblings)
14 siblings, 1 reply; 74+ messages in thread
From: Ian Rogers @ 2026-08-09 7:14 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
The metrics() function can return a dictionary where the value is either
a string or a list of strings, so the type signature in the stub file
should be Union[str, List[str]].
Fixes: 430da3cd03b4 ("perf python: Add perf.pyi stubs file")
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/python/perf.pyi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/perf/python/perf.pyi b/tools/perf/python/perf.pyi
index f266c9baffd0..58b0b3ed819d 100644
--- a/tools/perf/python/perf.pyi
+++ b/tools/perf/python/perf.pyi
@@ -1,5 +1,5 @@
"""Type stubs for the perf Python module."""
-from typing import Callable, Dict, List, Optional, Any, Iterator
+from typing import Callable, Dict, List, Optional, Any, Iterator, Union
def config_get(name: str) -> Optional[str]:
"""Get a configuration value from perf config.
@@ -12,7 +12,7 @@ def config_get(name: str) -> Optional[str]:
"""
...
-def metrics() -> List[Dict[str, str]]:
+def metrics() -> List[Dict[str, Union[str, List[str]]]]:
"""Get a list of available metrics.
Returns:
--
2.55.0.679.g6767b8d81c-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* Re: [PATCH v3 12/15] perf python: Fix MetricGroup return type in perf.pyi
2026-08-09 7:14 ` [PATCH v3 12/15] perf python: Fix MetricGroup return type in perf.pyi Ian Rogers
@ 2026-08-09 7:27 ` sashiko-bot
0 siblings, 0 replies; 74+ messages in thread
From: sashiko-bot @ 2026-08-09 7:27 UTC (permalink / raw)
To: Ian Rogers; +Cc: linux-perf-users
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues:
- [High] Memory leak of PyObject references 'key' and 'value' in pyrf__metrics_cb upon success.
--
--- Patch [12]: [PATCH v3 12/15] perf python: Fix MetricGroup return type in perf.pyi ---
commit f9b984697afa89938af9de90c9da302a78dffa89
Author: Ian Rogers <irogers@google.com>
perf python: Fix MetricGroup return type in perf.pyi
The metrics() function can return a dictionary where the value is either
a string or a list of strings, so the type signature in the stub file
should be Union[str, List[str]].
> --- a/tools/perf/python/perf.pyi
> +++ b/tools/perf/python/perf.pyi
[ ... ]
> -def metrics() -> List[Dict[str, str]]:
> +def metrics() -> List[Dict[str, Union[str, List[str]]]]:
[Severity: High]
This isn't a bug introduced by this patch, but does the underlying C
implementation of the metrics function leak the 'key' and 'value' objects on
success?
Looking at pyrf__metrics_cb() in tools/perf/util/python.c, it appears
PyDict_SetItem is used without decrementing the reference counts afterward:
PyObject *key = dict ? PyUnicode_FromString("MetricGroup") : NULL;
PyObject *value = key ? pyrf__metrics_groups(pm) : NULL;
if (!value || PyDict_SetItem(dict, key, value) != 0) {
Py_XDECREF(key);
Py_XDECREF(value);
Py_XDECREF(dict);
return -ENOMEM;
}
Since PyDict_SetItem doesn't steal references, wouldn't the caller need to
decrement the reference counts for both 'key' and 'value' after a successful
insertion? Since they are only decremented in the error path, does this
result in a memory leak every time a metric group is processed?
> """Get a list of available metrics.
>
> Returns:
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260809071455.1221514-1-irogers@google.com?part=12
^ permalink raw reply [flat|nested] 74+ messages in thread
* [PATCH v3 13/15] perf python: Fix count_values memory leak in pyrf_evsel__read
2026-08-09 7:14 ` [PATCH v3 00/15] " Ian Rogers
` (11 preceding siblings ...)
2026-08-09 7:14 ` [PATCH v3 12/15] perf python: Fix MetricGroup return type in perf.pyi Ian Rogers
@ 2026-08-09 7:14 ` Ian Rogers
2026-08-09 7:14 ` [PATCH v3 14/15] perf python: Fix memory leak in pyrf__metrics_cb Ian Rogers
2026-08-09 7:14 ` [PATCH v3 15/15] perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads Ian Rogers
14 siblings, 0 replies; 74+ messages in thread
From: Ian Rogers @ 2026-08-09 7:14 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
In pyrf_evsel__read, if PyArg_ParseTuple fails, the allocated count_values
is leaked. Move the allocation of count_values after the PyArg_ParseTuple
call to prevent the memory leak.
Fixes: 739621f65702 ("perf python: Add evsel read method")
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/util/python.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index fe5afce17333..71431c9c2e76 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -2210,11 +2210,6 @@ static PyObject *pyrf_evsel__read(struct pyrf_evsel *pevsel,
CHECK_INITIALIZED(evsel, "evsel");
- count_values = PyObject_New(struct pyrf_counts_values,
- &pyrf_counts_values__type);
- if (!count_values)
- return NULL;
-
if (!PyArg_ParseTuple(args, "ii", &cpu, &thread))
return NULL;
@@ -2233,6 +2228,10 @@ static PyObject *pyrf_evsel__read(struct pyrf_evsel *pevsel,
if (evsel__ensure_counts(evsel))
return PyErr_NoMemory();
+ count_values = PyObject_New(struct pyrf_counts_values, &pyrf_counts_values__type);
+ if (!count_values)
+ return NULL;
+
/* Set up pointers to the old and newly read counter values. */
old_count = perf_counts(evsel->prev_raw_counts, cpu_idx, thread_idx);
new_count = perf_counts(evsel->counts, cpu_idx, thread_idx);
--
2.55.0.679.g6767b8d81c-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* [PATCH v3 14/15] perf python: Fix memory leak in pyrf__metrics_cb
2026-08-09 7:14 ` [PATCH v3 00/15] " Ian Rogers
` (12 preceding siblings ...)
2026-08-09 7:14 ` [PATCH v3 13/15] perf python: Fix count_values memory leak in pyrf_evsel__read Ian Rogers
@ 2026-08-09 7:14 ` Ian Rogers
2026-08-09 7:14 ` [PATCH v3 15/15] perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads Ian Rogers
14 siblings, 0 replies; 74+ messages in thread
From: Ian Rogers @ 2026-08-09 7:14 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
In pyrf__metrics_cb, PyDict_SetItem does not steal the reference of the
key and value, so they need to be decref'ed after successful insertion
to avoid memory leaks.
Fixes: 47b3e95728eb ("perf python: Add metrics function")
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/util/python.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index 71431c9c2e76..077e0f5d9fcd 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -3574,6 +3574,8 @@ static int pyrf__metrics_cb(const struct pmu_metric *pm,
Py_XDECREF(dict);
return -ENOMEM;
}
+ Py_DECREF(key);
+ Py_DECREF(value);
if (!add_to_dict(dict, "MetricName", pm->metric_name) ||
!add_to_dict(dict, "PMU", pm->pmu) ||
--
2.55.0.679.g6767b8d81c-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread* [PATCH v3 15/15] perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads
2026-08-09 7:14 ` [PATCH v3 00/15] " Ian Rogers
` (13 preceding siblings ...)
2026-08-09 7:14 ` [PATCH v3 14/15] perf python: Fix memory leak in pyrf__metrics_cb Ian Rogers
@ 2026-08-09 7:14 ` Ian Rogers
14 siblings, 0 replies; 74+ messages in thread
From: Ian Rogers @ 2026-08-09 7:14 UTC (permalink / raw)
To: irogers, acme, namhyung
Cc: adrian.hunter, alice.mei.rogers, dapeng1.mi, james.clark, leo.yan,
linux-kernel, linux-perf-users, mingo, peterz, tmricht
If scandir() finds no matching tasks in /proc, n is 0. If thread_nr is > 1,
we bypass the single-thread fast path and then clamp thread_nr to n, making
it 0. This results in a divide by zero when calculating num_per_thread.
Handle n <= 1 early to use the single-thread fast path and prevent the
crash.
Fixes: 340b47f510bb ("perf top: Implement multithreading for perf_event__synthesize_threads")
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/util/synthetic-events.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic-events.c
index 3583a60cc487..0c150193cca8 100644
--- a/tools/perf/util/synthetic-events.c
+++ b/tools/perf/util/synthetic-events.c
@@ -1175,7 +1175,7 @@ int perf_event__synthesize_threads(const struct perf_tool *tool,
else
thread_nr = nr_threads_synthesize;
- if (thread_nr <= 1) {
+ if (thread_nr <= 1 || n <= 1) {
err = __perf_event__synthesize_threads(tool, process,
machine,
needs_mmap, mmap_data,
--
2.55.0.679.g6767b8d81c-goog
^ permalink raw reply related [flat|nested] 74+ messages in thread