[PATCH v2 0/4] perf annotate-data: Support flexible array types

[PATCH v2 0/4] perf annotate-data: Support flexible array types

[Namhyung Kim]

Hello,

The flexible arrays are dynamically allocated with different size.  So checking
with the original type size won't match and cannot match the sample.  This patch
series detects those flex-arrays and allows accesses beyond the original size.

I'm not sure what's the best way to add test codes for data type profiling as it
seems we need to add a lot more workloads for different cases.  Probably we may
want to split the workloads as separate binaries.

v2 changes)
 * fix missing index increment in the histogram
 * support flex array in union types
 * add recursion check in die_has_flex_array()
 * check negative index arrays properly
 * avoid divide-by-zero when the size is unknown

v1: https://lore.kernel.org/r/20260912054706.1475583-1-namhyung@kernel.org

Thanks,
Namhyung


Cc: Zecheng Li <zli94@ncsu.edu>
Cc: Yanbo Zhao <yzhao62@ncsu.edu>
Cc: Tengda Wu <wutengda@huaweicloud.com>
Cc: Shuai Xue <xueshuai@linux.alibaba.com>

Namhyung Kim (4):
  perf annotate-data: Convert type histogram to hashmap
  perf dwarf-aux: Add die_has_flex_array() helper
  perf annotate-date: Allow out-of-size access for flex-array types
  perf annotate-data: Adjust type offset for flex-array

 tools/perf/ui/browsers/annotate-data.c |  10 +-
 tools/perf/util/annotate-data.c        | 209 +++++++++++++++++--------
 tools/perf/util/annotate-data.h        |  10 +-
 tools/perf/util/dwarf-aux.c            |  77 +++++++++
 tools/perf/util/dwarf-aux.h            |   3 +
 5 files changed, 241 insertions(+), 68 deletions(-)

-- 
2.55.0.1032.g73a4cd73de-goog

[PATCH v2 1/4] perf annotate-data: Convert type histogram to hashmap

[Namhyung Kim]

The type histogram maintains sample counts and periods per offset.  Use
a hashmap instead of an array to reduce the memory overhead.

No functional changes intended.

Signed-off-by: Namhyung Kim <namhyung@kernel.org>
---
 tools/perf/ui/browsers/annotate-data.c | 10 ++--
 tools/perf/util/annotate-data.c        | 72 ++++++++++++++++----------
 tools/perf/util/annotate-data.h        |  8 +--
 3 files changed, 57 insertions(+), 33 deletions(-)

diff --git a/tools/perf/ui/browsers/annotate-data.c b/tools/perf/ui/browsers/annotate-data.c
index aa8c89fe2e82c1c5..c6e07a9b64089ab5 100644
--- a/tools/perf/ui/browsers/annotate-data.c
+++ b/tools/perf/ui/browsers/annotate-data.c
@@ -62,12 +62,16 @@ static int get_member_overhead(struct annotated_data_type *adt,
 
 		k = 0;
 		for_each_group_evsel(evsel, leader) {
+			struct type_hist_entry *hist;
+
 			if (symbol_conf.skip_empty &&
 			    evsel__hists(evsel)->stats.nr_samples == 0)
 				continue;
 
-			h = adt->histograms[evsel->core.idx];
-			update_hist_entry(&entry->hists[k++], &h->addr[offset]);
+			h = &adt->histograms[evsel->core.idx];
+			if (hashmap__find(&h->samples, offset, &hist))
+				update_hist_entry(&entry->hists[k], hist);
+			k++;
 		}
 	}
 	return 0;
@@ -416,7 +420,7 @@ static void browser__write(struct ui_browser *uib, void *entry, int row)
 
 	/* print the number */
 	for_each_group_evsel(evsel, leader) {
-		struct type_hist *h = adt->histograms[evsel->core.idx];
+		struct type_hist *h = &adt->histograms[evsel->core.idx];
 
 		if (symbol_conf.skip_empty &&
 		    evsel__hists(evsel)->stats.nr_samples == 0)
diff --git a/tools/perf/util/annotate-data.c b/tools/perf/util/annotate-data.c
index 4e4c587640823c81..aff60a630fd05b01 100644
--- a/tools/perf/util/annotate-data.c
+++ b/tools/perf/util/annotate-data.c
@@ -1750,42 +1750,45 @@ struct annotated_data_type *find_data_type(struct data_loc_info *dloc)
 	return dso__findnew_data_type(dso, &type_die);
 }
 
+static size_t data_type_hash(long key, void *ctx __maybe_unused)
+{
+	return key;
+}
+
+static bool data_type_equal(long key1, long key2, void *ctx __maybe_unused)
+{
+	return key1 == key2;
+}
+
 static int alloc_data_type_histograms(struct annotated_data_type *adt, int nr_entries)
 {
 	int i;
-	size_t sz = sizeof(struct type_hist);
 
-	sz += sizeof(struct type_hist_entry) * adt->self.size;
-
-	/* Allocate a table of pointers for each event */
+	/* Allocate a histogram for each event */
 	adt->histograms = calloc(nr_entries, sizeof(*adt->histograms));
 	if (adt->histograms == NULL)
 		return -ENOMEM;
 
-	/*
-	 * Each histogram is allocated for the whole size of the type.
-	 * TODO: Probably we can move the histogram to members.
-	 */
 	for (i = 0; i < nr_entries; i++) {
-		adt->histograms[i] = zalloc(sz);
-		if (adt->histograms[i] == NULL)
-			goto err;
+		hashmap__init(&adt->histograms[i].samples, data_type_hash,
+			      data_type_equal, /*ctx=*/NULL);
 	}
 
 	adt->nr_histograms = nr_entries;
 	return 0;
-
-err:
-	while (--i >= 0)
-		zfree(&(adt->histograms[i]));
-	zfree(&adt->histograms);
-	return -ENOMEM;
 }
 
 static void delete_data_type_histograms(struct annotated_data_type *adt)
 {
-	for (int i = 0; i < adt->nr_histograms; i++)
-		zfree(&(adt->histograms[i]));
+	for (int i = 0; i < adt->nr_histograms; i++) {
+		struct hashmap *map = &adt->histograms[i].samples;
+		struct hashmap_entry *pos, *tmp;
+		size_t bkt;
+
+		hashmap__for_each_entry_safe(map, pos, tmp, bkt)
+			free(pos->pvalue);
+		hashmap__clear(map);
+	}
 
 	zfree(&adt->histograms);
 	adt->nr_histograms = 0;
@@ -1824,6 +1827,7 @@ int annotated_data_type__update_samples(struct annotated_data_type *adt,
 					int nr_samples, u64 period)
 {
 	struct type_hist *h;
+	struct type_hist_entry *entry;
 
 	if (adt == NULL)
 		return 0;
@@ -1838,12 +1842,23 @@ int annotated_data_type__update_samples(struct annotated_data_type *adt,
 	if (offset < 0 || offset >= adt->self.size)
 		return -1;
 
-	h = adt->histograms[evsel->core.idx];
+	h = &adt->histograms[evsel->core.idx];
 
 	h->nr_samples += nr_samples;
-	h->addr[offset].nr_samples += nr_samples;
 	h->period += period;
-	h->addr[offset].period += period;
+
+	if (!hashmap__find(&h->samples, offset, &entry)) {
+		entry = zalloc(sizeof(*entry));
+		if (entry == NULL)
+			return -1;
+
+		if (hashmap__append(&h->samples, offset, entry) < 0) {
+			free(entry);
+			return -1;
+		}
+	}
+	entry->nr_samples += nr_samples;
+	entry->period += period;
 	return 0;
 }
 
@@ -1911,14 +1926,14 @@ static void print_annotated_data_type(struct annotated_data_type *mem_type,
 				      struct evsel *evsel, int indent)
 {
 	struct annotated_member *child;
-	struct type_hist *h = mem_type->histograms[evsel->core.idx];
+	struct type_hist *h;
 	int i, nr_events = 0, samples = 0;
 	u64 period = 0;
 	int width = symbol_conf.show_total_period ? 11 : 7;
 	struct evsel *pos;
 
 	for_each_group_evsel(pos, evsel) {
-		h = mem_type->histograms[pos->core.idx];
+		h = &mem_type->histograms[pos->core.idx];
 
 		if (symbol_conf.skip_empty &&
 		    evsel__hists(pos)->stats.nr_samples == 0)
@@ -1927,8 +1942,13 @@ static void print_annotated_data_type(struct annotated_data_type *mem_type,
 		samples = 0;
 		period = 0;
 		for (i = 0; i < member->size; i++) {
-			samples += h->addr[member->offset + i].nr_samples;
-			period += h->addr[member->offset + i].period;
+			struct type_hist_entry *entry;
+
+			if (!hashmap__find(&h->samples, member->offset + i, &entry))
+				continue;
+
+			samples += entry->nr_samples;
+			period += entry->period;
 		}
 		print_annotated_data_value(h, period, samples);
 		nr_events++;
diff --git a/tools/perf/util/annotate-data.h b/tools/perf/util/annotate-data.h
index c26130744260955f..ca2096a9ee62cbfe 100644
--- a/tools/perf/util/annotate-data.h
+++ b/tools/perf/util/annotate-data.h
@@ -73,12 +73,12 @@ struct type_hist_entry {
  * struct type_hist - Type histogram for each event
  * @nr_samples: Total number of samples in this data type
  * @period: Total count of the event in this data type
- * @offset: Array of histogram entry
+ * @samples: Hashmap of (offset, type_hist_entry)
  */
 struct type_hist {
 	u64			nr_samples;
 	u64			period;
-	struct type_hist_entry	addr[];
+	struct hashmap		samples;
 };
 
 /**
@@ -86,7 +86,7 @@ struct type_hist {
  * @node: RB-tree node for dso->type_tree
  * @self: Actual type information
  * @nr_histogram: Number of histogram entries
- * @histograms: An array of pointers to histograms
+ * @histograms: An array of histograms
  *
  * This represents a data type accessed by samples in the profile data.
  */
@@ -94,7 +94,7 @@ struct annotated_data_type {
 	struct rb_node node;
 	struct annotated_member self;
 	int nr_histograms;
-	struct type_hist **histograms;
+	struct type_hist *histograms;
 };
 
 extern struct annotated_data_type unknown_type;
-- 
2.55.0.1032.g73a4cd73de-goog

[PATCH v2 2/4] perf dwarf-aux: Add die_has_flex_array() helper

[Namhyung Kim]

The die_has_flex_array() returns true when the given type is a compound
type and contains an array at the end.  To prevent an infinite recursion
add a depth field to the internal function.

Cc: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
---
 tools/perf/util/dwarf-aux.c | 77 +++++++++++++++++++++++++++++++++++++
 tools/perf/util/dwarf-aux.h |  3 ++
 2 files changed, 80 insertions(+)

diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
index d7160f87ac7d7ab3..465824e6513eb0ac 100644
--- a/tools/perf/util/dwarf-aux.c
+++ b/tools/perf/util/dwarf-aux.c
@@ -2180,3 +2180,80 @@ Dwarf_Die *die_deref_ptr_type(Dwarf_Die *ptr_die, int offset,
 
 	return die_get_member_type(&type_die, offset, die_mem);
 }
+
+static bool is_flex_array_member(Dwarf_Die *mb_die)
+{
+	Dwarf_Die type_die;
+	Dwarf_Word size;
+
+	/* get the type of the member */
+	if (die_get_real_type(mb_die, &type_die) == NULL)
+		return false;
+
+	if (dwarf_tag(&type_die) != DW_TAG_array_type)
+		return false;
+
+	return dwarf_aggregate_size(&type_die, &size) < 0 || size == 0;
+}
+
+#define MAX_FLEX_ARRAY_RECURSION  256  /* arbitrary */
+
+static bool die_has_flex_array_recurse(Dwarf_Die *parent_die, int depth)
+{
+	Dwarf_Die die_mem, last_mb;
+	int tag = dwarf_tag(parent_die);
+
+	if (tag != DW_TAG_structure_type && tag != DW_TAG_union_type)
+		return false;
+
+	/* prevent infinite recursion */
+	if (depth > MAX_FLEX_ARRAY_RECURSION)
+		return false;
+
+	if (dwarf_child(parent_die, &die_mem))
+		return false;
+
+	do {
+		if (dwarf_tag(&die_mem) != DW_TAG_member)
+			continue;
+
+		if (tag == DW_TAG_union_type) {
+			if (is_flex_array_member(&die_mem))
+				return true;
+
+			if (die_get_real_type(&die_mem, &last_mb) &&
+			    die_has_flex_array_recurse(&last_mb, depth + 1))
+				return true;
+		}
+
+		if (tag == DW_TAG_structure_type)
+			memcpy(&last_mb, &die_mem, sizeof(last_mb));
+
+	} while (dwarf_siblingof(&die_mem, &die_mem) == 0);
+
+	if (tag == DW_TAG_structure_type) {
+		if (is_flex_array_member(&last_mb))
+			return true;
+
+		if (die_get_real_type(&last_mb, &die_mem))
+			return die_has_flex_array_recurse(&die_mem, depth + 1);
+	}
+
+	return false;
+}
+
+/**
+ * die_has_flex_array - Check if the given type has a flex-array at the end
+ * @parent_die: a pointer to type DIE
+ *
+ * This function returns %true iff @parent_die is a struct type and has an
+ * array at the end.  Note that the flex-array has no element, it should have
+ * no size and the parent size doesn't include the flex-array.  So it should
+ * locate at the offset of the parent size.
+ *
+ * For simplicity, it assumes the parent size of aligned with the flex-array.
+ */
+bool die_has_flex_array(Dwarf_Die *parent_die)
+{
+	return die_has_flex_array_recurse(parent_die, 0);
+}
diff --git a/tools/perf/util/dwarf-aux.h b/tools/perf/util/dwarf-aux.h
index 161f0bf980b6ee6a..9b662db710220522 100644
--- a/tools/perf/util/dwarf-aux.h
+++ b/tools/perf/util/dwarf-aux.h
@@ -189,4 +189,7 @@ void die_collect_global_vars(Dwarf_Die *cu_die, struct die_var_type **var_types)
 /* Get the frame base information from CFA */
 int die_get_cfa(Dwarf *dwarf, u64 pc, int *preg, int *poffset);
 
+/* Check whether given type has a flex array */
+bool die_has_flex_array(Dwarf_Die *parent_die);
+
 #endif /* _DWARF_AUX_H */
-- 
2.55.0.1032.g73a4cd73de-goog

[PATCH v2 3/4] perf annotate-date: Allow out-of-size access for flex-array types

[Namhyung Kim]

Structs that have a flex array will have accesses beyond its original
size as the array was declared as 0 sized.  For now, it just allow any
offset bigger than the size.  It could be refined later.

Signed-off-by: Namhyung Kim <namhyung@kernel.org>
---
 tools/perf/util/annotate-data.c | 63 ++++++++++++++++++---------------
 tools/perf/util/annotate-data.h |  2 ++
 2 files changed, 36 insertions(+), 29 deletions(-)

diff --git a/tools/perf/util/annotate-data.c b/tools/perf/util/annotate-data.c
index aff60a630fd05b01..e8aff6a916c0afe0 100644
--- a/tools/perf/util/annotate-data.c
+++ b/tools/perf/util/annotate-data.c
@@ -7,6 +7,7 @@
 #include <errno.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <string.h>
 #include <inttypes.h>
 #include <linux/zalloc.h>
 
@@ -248,8 +249,15 @@ static int __add_member_cb(Dwarf_Die *die, void *arg)
 	else
 		die_mem = member_type;
 
-	if (dwarf_aggregate_size(&die_mem, &size) < 0)
-		size = 0;
+	if (dwarf_aggregate_size(&die_mem, &size) < 0) {
+		if (dwarf_tag(&die_mem) == DW_TAG_array_type) { /* flex-array? */
+			die_get_real_type(&die_mem, &die_mem);
+			if (dwarf_aggregate_size(&die_mem, &size) < 0)
+				size = 0;
+		} else {
+			size = 0;
+		}
+	}
 
 	if (dwarf_attr_integrate(die, DW_AT_data_member_location, &attr)) {
 		if (dwarf_formudata(&attr, &loc) != 0) {
@@ -399,6 +407,7 @@ static struct annotated_data_type *dso__findnew_data_type(struct dso *dso,
 	result->self.type_name = type_name;
 	result->self.size = size;
 	INIT_LIST_HEAD(&result->self.children);
+	result->flex_array = die_has_flex_array(type_die);
 
 	if (symbol_conf.annotate_data_member)
 		add_member_types(result, type_die);
@@ -517,13 +526,30 @@ static bool is_better_type(Dwarf_Die *type_a, Dwarf_Die *type_b)
 	return false;
 }
 
+static enum type_match_result check_type_offset(Dwarf_Die *type_die, int offset)
+{
+	Dwarf_Word size;
+
+	/* Get the size of the actual type */
+	if (dwarf_aggregate_size(type_die, &size) < 0)
+		return PERF_TMR_NO_SIZE;
+
+	/* Minimal sanity check */
+	if (offset < 0)
+		return PERF_TMR_BAD_OFFSET;
+
+	if ((unsigned)offset >= size && !die_has_flex_array(type_die))
+		return PERF_TMR_BAD_OFFSET;
+
+	return PERF_TMR_OK;
+}
+
 /* The type info will be saved in @type_die */
 static enum type_match_result check_variable(struct data_loc_info *dloc,
 					     Dwarf_Die *var_die,
 					     Dwarf_Die *type_die, int reg,
 					     int offset, bool is_fbreg)
 {
-	Dwarf_Word size;
 	bool needs_pointer = true;
 	Dwarf_Die sized_type;
 
@@ -554,15 +580,7 @@ static enum type_match_result check_variable(struct data_loc_info *dloc,
 	else
 		sized_type = *type_die;
 
-	/* Get the size of the actual type */
-	if (dwarf_aggregate_size(&sized_type, &size) < 0)
-		return PERF_TMR_NO_SIZE;
-
-	/* Minimal sanity check */
-	if ((unsigned)offset >= size)
-		return PERF_TMR_BAD_OFFSET;
-
-	return PERF_TMR_OK;
+	return check_type_offset(type_die, offset);
 }
 
 struct type_state_stack *find_stack_state(struct type_state *state,
@@ -1112,7 +1130,6 @@ static enum type_match_result check_matching_type(struct type_state *state,
 						  struct disasm_line *dl,
 						  Dwarf_Die *type_die)
 {
-	Dwarf_Word size;
 	u32 insn_offset = dl->al.offset;
 	int reg = dloc->op->reg1;
 	int offset = dloc->op->offset;
@@ -1166,12 +1183,7 @@ static enum type_match_result check_matching_type(struct type_state *state,
 		else
 			sized_type = *type_die;
 
-		/* Get the size of the actual type */
-		if (dwarf_aggregate_size(&sized_type, &size) < 0 ||
-		    (unsigned)dloc->type_offset >= size)
-			return PERF_TMR_BAD_OFFSET;
-
-		return PERF_TMR_OK;
+		return check_type_offset(&sized_type, dloc->type_offset);
 	}
 
 	if (state->regs[reg].kind == TSR_KIND_POINTER) {
@@ -1190,12 +1202,7 @@ static enum type_match_result check_matching_type(struct type_state *state,
 
 		dloc->type_offset = dloc->op->offset + state->regs[reg].offset;
 
-		/* Get the size of the actual type */
-		if (dwarf_aggregate_size(type_die, &size) < 0 ||
-		    (unsigned)dloc->type_offset >= size)
-			return PERF_TMR_BAD_OFFSET;
-
-		return PERF_TMR_OK;
+		return check_type_offset(type_die, dloc->type_offset);
 	}
 
 	if (state->regs[reg].kind == TSR_KIND_PERCPU_POINTER) {
@@ -1209,9 +1216,7 @@ static enum type_match_result check_matching_type(struct type_state *state,
 
 		dloc->type_offset = dloc->op->offset;
 
-		/* Get the size of the actual type */
-		if (dwarf_aggregate_size(type_die, &size) < 0 ||
-		    (unsigned)dloc->type_offset >= size)
+		if (check_type_offset(type_die, dloc->type_offset) != PERF_TMR_OK)
 			return PERF_TMR_BAIL_OUT;
 
 		return PERF_TMR_OK;
@@ -1839,7 +1844,7 @@ int annotated_data_type__update_samples(struct annotated_data_type *adt,
 			return -1;
 	}
 
-	if (offset < 0 || offset >= adt->self.size)
+	if (offset < 0 || (offset >= adt->self.size && !adt->flex_array))
 		return -1;
 
 	h = &adt->histograms[evsel->core.idx];
diff --git a/tools/perf/util/annotate-data.h b/tools/perf/util/annotate-data.h
index ca2096a9ee62cbfe..27b7148b64f60350 100644
--- a/tools/perf/util/annotate-data.h
+++ b/tools/perf/util/annotate-data.h
@@ -85,6 +85,7 @@ struct type_hist {
  * struct annotated_data_type - Data type to profile
  * @node: RB-tree node for dso->type_tree
  * @self: Actual type information
+ * @flex_array: Whethere it has a flex array
  * @nr_histogram: Number of histogram entries
  * @histograms: An array of histograms
  *
@@ -93,6 +94,7 @@ struct type_hist {
 struct annotated_data_type {
 	struct rb_node node;
 	struct annotated_member self;
+	bool flex_array;
 	int nr_histograms;
 	struct type_hist *histograms;
 };
-- 
2.55.0.1032.g73a4cd73de-goog

[PATCH v2 4/4] perf annotate-data: Adjust type offset for flex-array

[Namhyung Kim]

The flex array members are located beyond the original type size.  Also
it needs to adjust the offset in an array to find a corresponding
element using module operation.  Note that we focus on access to type and
field, so array index is not important.

Make sure to find a field name for flex arrays.

Signed-off-by: Namhyung Kim <namhyung@kernel.org>
---
 tools/perf/util/annotate-data.c | 74 ++++++++++++++++++++++++++++++---
 1 file changed, 68 insertions(+), 6 deletions(-)

diff --git a/tools/perf/util/annotate-data.c b/tools/perf/util/annotate-data.c
index e8aff6a916c0afe0..a66b72feb6e2f227 100644
--- a/tools/perf/util/annotate-data.c
+++ b/tools/perf/util/annotate-data.c
@@ -333,19 +333,40 @@ static void delete_members(struct annotated_member *member)
 }
 
 static int fill_member_name(char *buf, size_t sz, struct annotated_member *m,
-			    int offset, bool first)
+			    int offset, bool first, bool has_flex_array)
 {
 	struct annotated_member *child;
+	bool found = false;
+	int len;
 
 	if (list_empty(&m->children))
 		return 0;
 
 	list_for_each_entry(child, &m->children, node) {
-		int len;
-
 		if (offset < child->offset || offset >= child->offset + child->size)
 			continue;
 
+		found = true;
+		break;
+	}
+
+	if (!found && has_flex_array) {
+		/*
+		 * It may have an intermediate struct that has another struct that
+		 * contains a flex array.  In that case, the outer struct itself is
+		 * has no array and the size is less than the offset so the above
+		 * logic won't find the outer struct at the offset.  Let's use the
+		 * last struct if it couldn't find a member for the flex array.
+		 */
+		child = list_last_entry(&m->children, struct annotated_member, node);
+
+		if (offset < child->offset)
+			return 0;
+
+		found = true;
+	}
+
+	if (found) {
 		/* It can have anonymous struct/union members */
 		if (child->var_name) {
 			len = scnprintf(buf, sz, "%s%s",
@@ -355,15 +376,37 @@ static int fill_member_name(char *buf, size_t sz, struct annotated_member *m,
 			len = 0;
 		}
 
-		return fill_member_name(buf + len, sz - len, child, offset, first) + len;
+		return fill_member_name(buf + len, sz - len, child, offset, first,
+					has_flex_array) + len;
 	}
+
 	return 0;
 }
 
 int annotated_data_type__get_member_name(struct annotated_data_type *adt,
 					 char *buf, size_t sz, int member_offset)
 {
-	return fill_member_name(buf, sz, &adt->self, member_offset, /*first=*/true);
+	return fill_member_name(buf, sz, &adt->self, member_offset, /*first=*/true,
+				adt->flex_array);
+}
+
+static struct annotated_member *find_flex_array(struct annotated_member *m)
+{
+	struct annotated_member *child;
+
+	if (list_empty(&m->children))
+		return NULL;
+
+	child = list_last_entry(&m->children, struct annotated_member, node);
+	if (strstr(child->type_name, "[]"))
+		return child;
+
+	return find_flex_array(child);
+}
+
+static struct annotated_member *get_flex_array_member(struct annotated_data_type *adt)
+{
+	return find_flex_array(&adt->self);
 }
 
 static struct annotated_data_type *dso__findnew_data_type(struct dso *dso,
@@ -1740,6 +1783,7 @@ struct annotated_data_type *find_data_type(struct data_loc_info *dloc)
 {
 	struct dso *dso = map__dso(dloc->ms->map);
 	Dwarf_Die type_die;
+	struct annotated_data_type *result;
 
 	/*
 	 * The type offset is the same as instruction offset by default.
@@ -1752,7 +1796,25 @@ struct annotated_data_type *find_data_type(struct data_loc_info *dloc)
 	if (find_data_type_die(dloc, &type_die) < 0)
 		return NULL;
 
-	return dso__findnew_data_type(dso, &type_die);
+	result = dso__findnew_data_type(dso, &type_die);
+	if (result == NULL)
+		return NULL;
+
+	if (result->flex_array && dloc->type_offset > result->self.size) {
+		struct annotated_member *flex_array = get_flex_array_member(result);
+
+		if (flex_array && flex_array->size > 0) {
+			int offset = dloc->type_offset;
+
+			/* adjust offset in the flex array */
+			offset -= flex_array->offset;
+			offset %= flex_array->size;
+			offset += flex_array->offset;
+
+			dloc->type_offset = offset;
+		}
+	}
+	return result;
 }
 
 static size_t data_type_hash(long key, void *ctx __maybe_unused)
-- 
2.55.0.1032.g73a4cd73de-goog

Re: [PATCH v2 2/4] perf dwarf-aux: Add die_has_flex_array() helper

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] The local variable `last_mb` is accessed uninitialized if a struct contains DWARF children but none of them are data members.
- [Low] Missing explicit inclusion of `<string.h>` for `memcpy` usage, violating the POSIX libc headers subsystem rule.
--

commit 63614557ac58c6c9c6f30f55cff70e30709d2a8b
Author: Namhyung Kim <namhyung@kernel.org>

perf dwarf-aux: Add die_has_flex_array() helper

The die_has_flex_array() returns true when the given type is a compound
type and contains an array at the end.  To prevent an infinite recursion
add a depth field to the internal function.

> diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
> index d7160f87ac7d7..465824e6513eb 100644
> --- a/tools/perf/util/dwarf-aux.c
> +++ b/tools/perf/util/dwarf-aux.c
[ ... ]
> +static bool die_has_flex_array_recurse(Dwarf_Die *parent_die, int depth)
> +{
> +	Dwarf_Die die_mem, last_mb;
> +	int tag = dwarf_tag(parent_die);
> +
> +	if (tag != DW_TAG_structure_type && tag != DW_TAG_union_type)
> +		return false;
> +
> +	/* prevent infinite recursion */
> +	if (depth > MAX_FLEX_ARRAY_RECURSION)
> +		return false;
> +
> +	if (dwarf_child(parent_die, &die_mem))
> +		return false;
> +
> +	do {
> +		if (dwarf_tag(&die_mem) != DW_TAG_member)
> +			continue;
> +
> +		if (tag == DW_TAG_union_type) {
> +			if (is_flex_array_member(&die_mem))
> +				return true;
> +
> +			if (die_get_real_type(&die_mem, &last_mb) &&
> +			    die_has_flex_array_recurse(&last_mb, depth + 1))
> +				return true;
> +		}
> +
> +		if (tag == DW_TAG_structure_type)
> +			memcpy(&last_mb, &die_mem, sizeof(last_mb));
                        ^^^^^^
[Severity: Low]
This isn't a bug, but this memcpy() call relies on implicit inclusion of
<string.h>. Should we explicitly include <string.h> at the top of the file
to ensure musl compatibility?

> +
> +	} while (dwarf_siblingof(&die_mem, &die_mem) == 0);
> +
> +	if (tag == DW_TAG_structure_type) {
> +		if (is_flex_array_member(&last_mb))
                    ^^^^^^^^^^^^^^^^^^^^
[Severity: High]
If a structure has DWARF children (such as DW_TAG_subprogram or
DW_TAG_typedef), but none of them are DW_TAG_member, the memcpy() above is
skipped due to the continue statement.

Will this cause is_flex_array_member() to access an uninitialized
last_mb variable?

> +			return true;
> +
> +		if (die_get_real_type(&last_mb, &die_mem))
> +			return die_has_flex_array_recurse(&die_mem, depth + 1);
> +	}
> +
> +	return false;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260914064535.1671939-1-namhyung@kernel.org?part=2

Re: [PATCH v2 1/4] perf annotate-data: Convert type histogram to hashmap

[sashiko-bot]

> The type histogram maintains sample counts and periods per offset.  Use
> a hashmap instead of an array to reduce the memory overhead.
> 
> No functional changes intended.
> 
> Signed-off-by: Namhyung Kim <namhyung@kernel.org>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260914064535.1671939-1-namhyung@kernel.org?part=1

Re: [PATCH v2 3/4] perf annotate-date: Allow out-of-size access for flex-array types

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Medium] check_variable and check_matching_type fail to pass the typedef-resolved 'sized_type' to 'check_type_offset', causing an unused variable warning and breaking flex-array detection for typedefs.
- [Medium] Uninitialized stack variable 'last_mb' is used in 'die_has_flex_array_recurse' if a structure contains children but no data members.
--

commit cd675d28ffa1b31e0fe343fa27c89e7794eb74ec
Author: Namhyung Kim <namhyung@kernel.org>

perf annotate-date: Allow out-of-size access for flex-array types
    
Structs that have a flex array will have accesses beyond its original
size as the array was declared as 0 sized.  For now, it just allow any
offset bigger than the size.  It could be refined later.

> diff --git a/tools/perf/util/annotate-data.c b/tools/perf/util/annotate-data.c
> index aff60a630fd05..e8aff6a916c0a 100644
> --- a/tools/perf/util/annotate-data.c
> +++ b/tools/perf/util/annotate-data.c

[ ... ]

> @@ -399,6 +407,7 @@ static struct annotated_data_type *dso__findnew_data_type(struct dso *dso,
>  	result->self.type_name = type_name;
>  	result->self.size = size;
>  	INIT_LIST_HEAD(&result->self.children);
> +	result->flex_array = die_has_flex_array(type_die);

[Severity: Medium]
Will this call into die_has_flex_array_recurse() trigger an uninitialized
stack variable access for empty structures?

If the structure has child DIEs but none of them are DW_TAG_member, the
last_mb variable won't be assigned in the loop, leaving it uninitialized
when evaluated:

tools/perf/util/dwarf-aux.c:die_has_flex_array_recurse() {
	Dwarf_Die die_mem, last_mb;
...
	do {
		if (dwarf_tag(&die_mem) != DW_TAG_member)
			continue;
...
		if (tag == DW_TAG_structure_type)
			memcpy(&last_mb, &die_mem, sizeof(last_mb));

	} while (dwarf_siblingof(&die_mem, &die_mem) == 0);

	if (tag == DW_TAG_structure_type) {
		if (is_flex_array_member(&last_mb))
			return true;
...

Should last_mb be initialized, or should we track whether it was set before
calling is_flex_array_member()?

>  
>  	if (symbol_conf.annotate_data_member)
>  		add_member_types(result, type_die);

[ ... ]

> @@ -554,15 +580,7 @@ static enum type_match_result check_variable(struct data_loc_info *dloc,
>  	else
>  		sized_type = *type_die;
>  
> -	/* Get the size of the actual type */
> -	if (dwarf_aggregate_size(&sized_type, &size) < 0)
> -		return PERF_TMR_NO_SIZE;
> -
> -	/* Minimal sanity check */
> -	if ((unsigned)offset >= size)
> -		return PERF_TMR_BAD_OFFSET;
> -
> -	return PERF_TMR_OK;
> +	return check_type_offset(type_die, offset);
>  }

[Severity: Medium]
Should this pass &sized_type instead of type_die?

Passing type_die ignores the typedef resolution performed earlier in this
function and leaves sized_type completely unused. Since check_type_offset()
now evaluates die_has_flex_array(type_die), this might break flex-array
detection for types hidden behind typedefs.

[ ... ]

> @@ -1190,12 +1202,7 @@ static enum type_match_result check_matching_type(struct type_state *state,
>  
>  		dloc->type_offset = dloc->op->offset + state->regs[reg].offset;
>  
> -		/* Get the size of the actual type */
> -		if (dwarf_aggregate_size(type_die, &size) < 0 ||
> -		    (unsigned)dloc->type_offset >= size)
> -			return PERF_TMR_BAD_OFFSET;
> -
> -		return PERF_TMR_OK;
> +		return check_type_offset(type_die, dloc->type_offset);
>  	}

[Severity: Medium]
For pointer types here, should type_die also be stripped of typedefs before
checking the type offset?

Similar to the logic used for TSR_KIND_TYPE, flex-arrays might go undetected
if they are hidden behind unresolved typedefs.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260914064535.1671939-1-namhyung@kernel.org?part=3

Re: [PATCH v2 4/4] perf annotate-data: Adjust type offset for flex-array

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [Medium] Off-by-one error and tail padding overlap in flex-array offset adjustment causes accesses to be silently dropped and incorrectly attributed.
- [Medium] Calling `strstr()` on `child->type_name` without checking for NULL causes a segmentation fault if memory allocation failed during type name extraction.
- [Medium] The newly added `strstr(child->type_name, "[]")` call reads uninitialized heap memory, leading to out-of-bounds reads and potential crashes when analyzing malformed or unknown DWARF entries.
--

commit 546415e2740f53443f133b3600542636f3d84f31
Author: Namhyung Kim <namhyung@kernel.org>
perf annotate-data: Adjust type offset for flex-array

This commit adjusts the type offset for flexible array members that are located
beyond the original type size. It ensures a field name is found for flex arrays
by adjusting the offset in an array to find a corresponding element.

> diff --git a/tools/perf/util/annotate-data.c b/tools/perf/util/annotate-data.c
> index e8aff6a916c0a..a66b72feb6e2f 100644
> --- a/tools/perf/util/annotate-data.c
> +++ b/tools/perf/util/annotate-data.c

[ ... ]

> @@ -355,15 +376,37 @@ static int fill_member_name(char *buf, size_t sz, struct annotated_member *m,
>  			len = 0;
>  		}
>  
> -		return fill_member_name(buf + len, sz - len, child, offset, first) + len;
> +		return fill_member_name(buf + len, sz - len, child, offset, first,
> +					has_flex_array) + len;
>  	}
> +
>  	return 0;
>  }
>  
>  int annotated_data_type__get_member_name(struct annotated_data_type *adt,
>  					 char *buf, size_t sz, int member_offset)
>  {
> -	return fill_member_name(buf, sz, &adt->self, member_offset, /*first=*/true);
> +	return fill_member_name(buf, sz, &adt->self, member_offset, /*first=*/true,
> +				adt->flex_array);
> +}
> +
> +static struct annotated_member *find_flex_array(struct annotated_member *m)
> +{
> +	struct annotated_member *child;
> +
> +	if (list_empty(&m->children))
> +		return NULL;
> +
> +	child = list_last_entry(&m->children, struct annotated_member, node);
> +	if (strstr(child->type_name, "[]"))

[Severity: Medium]
Could this call to strstr() safely handle scenarios where child->type_name is
NULL or uninitialized?

During DWARF parsing, for instance in __add_member_cb(), if die_get_typename()
fails due to a malformed DWARF entry or memory exhaustion, strbuf_detach()
might return an uninitialized heap buffer or NULL. If that happens, does this
scan risk triggering a segmentation fault or an out-of-bounds read when looking
for the "[]" string?

> +		return child;
> +
> +	return find_flex_array(child);
> +}

[ ... ]

> @@ -1740,6 +1783,7 @@ struct annotated_data_type *find_data_type(struct data_loc_info *dloc)
>  {
>  	struct dso *dso = map__dso(dloc->ms->map);
>  	Dwarf_Die type_die;
> +	struct annotated_data_type *result;
>  
>  	/*
>  	 * The type offset is the same as instruction offset by default.
> @@ -1752,7 +1796,25 @@ struct annotated_data_type *find_data_type(struct data_loc_info *dloc)
>  	if (find_data_type_die(dloc, &type_die) < 0)
>  		return NULL;
>  
> -	return dso__findnew_data_type(dso, &type_die);
> +	result = dso__findnew_data_type(dso, &type_die);
> +	if (result == NULL)
> +		return NULL;
> +
> +	if (result->flex_array && dloc->type_offset > result->self.size) {

[Severity: Medium]
Will this boundary check correctly catch accesses that fall exactly on the
boundary or within the struct's tail padding?

If an event samples a flexible array element whose offset is greater than 
flex_array->offset but less than or equal to result->self.size (the total
padded size of the struct), it appears this condition evaluates to false.
Could this cause the offset adjustment to be skipped, causing valid sample
counts to be silently dropped during data presentation?

> +		struct annotated_member *flex_array = get_flex_array_member(result);
> +
> +		if (flex_array && flex_array->size > 0) {
> +			int offset = dloc->type_offset;
> +
> +			/* adjust offset in the flex array */
> +			offset -= flex_array->offset;
> +			offset %= flex_array->size;
> +			offset += flex_array->offset;
> +
> +			dloc->type_offset = offset;
> +		}
> +	}
> +	return result;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260914064535.1671939-1-namhyung@kernel.org?part=4

Re: [PATCH v2 2/4] perf dwarf-aux: Add die_has_flex_array() helper

[Tengda Wu]

On 2026/9/14 14:45, Namhyung Kim wrote:
> The die_has_flex_array() returns true when the given type is a compound
> type and contains an array at the end.  To prevent an infinite recursion
> add a depth field to the internal function.
> 
> Cc: Masami Hiramatsu <mhiramat@kernel.org>
> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
> ---
>  tools/perf/util/dwarf-aux.c | 77 +++++++++++++++++++++++++++++++++++++
>  tools/perf/util/dwarf-aux.h |  3 ++
>  2 files changed, 80 insertions(+)
> 
> diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
> index d7160f87ac7d7ab3..465824e6513eb0ac 100644
> --- a/tools/perf/util/dwarf-aux.c
> +++ b/tools/perf/util/dwarf-aux.c
> @@ -2180,3 +2180,80 @@ Dwarf_Die *die_deref_ptr_type(Dwarf_Die *ptr_die, int offset,
>  
>  	return die_get_member_type(&type_die, offset, die_mem);
>  }
> +
> +static bool is_flex_array_member(Dwarf_Die *mb_die)
> +{
> +	Dwarf_Die type_die;
> +	Dwarf_Word size;
> +
> +	/* get the type of the member */
> +	if (die_get_real_type(mb_die, &type_die) == NULL)
> +		return false;
> +
> +	if (dwarf_tag(&type_die) != DW_TAG_array_type)
> +		return false;
> +
> +	return dwarf_aggregate_size(&type_die, &size) < 0 || size == 0;
> +}
> +
> +#define MAX_FLEX_ARRAY_RECURSION  256  /* arbitrary */
> +
> +static bool die_has_flex_array_recurse(Dwarf_Die *parent_die, int depth)
> +{
> +	Dwarf_Die die_mem, last_mb;
> +	int tag = dwarf_tag(parent_die);
> +
> +	if (tag != DW_TAG_structure_type && tag != DW_TAG_union_type)
> +		return false;
> +
> +	/* prevent infinite recursion */
> +	if (depth > MAX_FLEX_ARRAY_RECURSION)
> +		return false;
> +
> +	if (dwarf_child(parent_die, &die_mem))
> +		return false;
> +
> +	do {
> +		if (dwarf_tag(&die_mem) != DW_TAG_member)
> +			continue;
> +
> +		if (tag == DW_TAG_union_type) {
> +			if (is_flex_array_member(&die_mem))
> +				return true;
> +
> +			if (die_get_real_type(&die_mem, &last_mb) &&
> +			    die_has_flex_array_recurse(&last_mb, depth + 1))
> +				return true;
> +		}
> +
> +		if (tag == DW_TAG_structure_type)
> +			memcpy(&last_mb, &die_mem, sizeof(last_mb));
> +
> +	} while (dwarf_siblingof(&die_mem, &die_mem) == 0);
> +
> +	if (tag == DW_TAG_structure_type) {
> +		if (is_flex_array_member(&last_mb))

Not sure if this case can actually happen, but adding a check for whether
last_mb is valid is probably better. (I see Sashiko flagged this too.)

Thanks,
Tengda

> +			return true;
> +
> +		if (die_get_real_type(&last_mb, &die_mem))
> +			return die_has_flex_array_recurse(&die_mem, depth + 1);
> +	}
> +
> +	return false;
> +}
> +
> +/**
> + * die_has_flex_array - Check if the given type has a flex-array at the end
> + * @parent_die: a pointer to type DIE
> + *
> + * This function returns %true iff @parent_die is a struct type and has an
> + * array at the end.  Note that the flex-array has no element, it should have
> + * no size and the parent size doesn't include the flex-array.  So it should
> + * locate at the offset of the parent size.
> + *
> + * For simplicity, it assumes the parent size of aligned with the flex-array.
> + */
> +bool die_has_flex_array(Dwarf_Die *parent_die)
> +{
> +	return die_has_flex_array_recurse(parent_die, 0);
> +}
> diff --git a/tools/perf/util/dwarf-aux.h b/tools/perf/util/dwarf-aux.h
> index 161f0bf980b6ee6a..9b662db710220522 100644
> --- a/tools/perf/util/dwarf-aux.h
> +++ b/tools/perf/util/dwarf-aux.h
> @@ -189,4 +189,7 @@ void die_collect_global_vars(Dwarf_Die *cu_die, struct die_var_type **var_types)
>  /* Get the frame base information from CFA */
>  int die_get_cfa(Dwarf *dwarf, u64 pc, int *preg, int *poffset);
>  
> +/* Check whether given type has a flex array */
> +bool die_has_flex_array(Dwarf_Die *parent_die);
> +
>  #endif /* _DWARF_AUX_H */

Re: [PATCH v2 3/4] perf annotate-date: Allow out-of-size access for flex-array types

[Tengda Wu]

On 2026/9/14 14:45, Namhyung Kim wrote:
> Structs that have a flex array will have accesses beyond its original
> size as the array was declared as 0 sized.  For now, it just allow any
> offset bigger than the size.  It could be refined later.
> 
> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
> ---
>  tools/perf/util/annotate-data.c | 63 ++++++++++++++++++---------------
>  tools/perf/util/annotate-data.h |  2 ++
>  2 files changed, 36 insertions(+), 29 deletions(-)
> 
> diff --git a/tools/perf/util/annotate-data.c b/tools/perf/util/annotate-data.c
> index aff60a630fd05b01..e8aff6a916c0afe0 100644
> --- a/tools/perf/util/annotate-data.c
> +++ b/tools/perf/util/annotate-data.c
> @@ -7,6 +7,7 @@
>  #include <errno.h>
>  #include <stdio.h>
>  #include <stdlib.h>
> +#include <string.h>
>  #include <inttypes.h>
>  #include <linux/zalloc.h>
>  
> @@ -248,8 +249,15 @@ static int __add_member_cb(Dwarf_Die *die, void *arg)
>  	else
>  		die_mem = member_type;
>  
> -	if (dwarf_aggregate_size(&die_mem, &size) < 0)
> -		size = 0;
> +	if (dwarf_aggregate_size(&die_mem, &size) < 0) {
> +		if (dwarf_tag(&die_mem) == DW_TAG_array_type) { /* flex-array? */
> +			die_get_real_type(&die_mem, &die_mem);
> +			if (dwarf_aggregate_size(&die_mem, &size) < 0)
> +				size = 0;
> +		} else {
> +			size = 0;
> +		}
> +	}
>  
>  	if (dwarf_attr_integrate(die, DW_AT_data_member_location, &attr)) {
>  		if (dwarf_formudata(&attr, &loc) != 0) {
> @@ -399,6 +407,7 @@ static struct annotated_data_type *dso__findnew_data_type(struct dso *dso,
>  	result->self.type_name = type_name;
>  	result->self.size = size;
>  	INIT_LIST_HEAD(&result->self.children);
> +	result->flex_array = die_has_flex_array(type_die);
>  
>  	if (symbol_conf.annotate_data_member)
>  		add_member_types(result, type_die);
> @@ -517,13 +526,30 @@ static bool is_better_type(Dwarf_Die *type_a, Dwarf_Die *type_b)
>  	return false;
>  }
>  
> +static enum type_match_result check_type_offset(Dwarf_Die *type_die, int offset)
> +{
> +	Dwarf_Word size;
> +
> +	/* Get the size of the actual type */
> +	if (dwarf_aggregate_size(type_die, &size) < 0)
> +		return PERF_TMR_NO_SIZE;
> +
> +	/* Minimal sanity check */
> +	if (offset < 0)
> +		return PERF_TMR_BAD_OFFSET;
> +
> +	if ((unsigned)offset >= size && !die_has_flex_array(type_die))
> +		return PERF_TMR_BAD_OFFSET;
> +
> +	return PERF_TMR_OK;
> +}
> +
>  /* The type info will be saved in @type_die */
>  static enum type_match_result check_variable(struct data_loc_info *dloc,
>  					     Dwarf_Die *var_die,
>  					     Dwarf_Die *type_die, int reg,
>  					     int offset, bool is_fbreg)
>  {
> -	Dwarf_Word size;
>  	bool needs_pointer = true;
>  	Dwarf_Die sized_type;
>  
> @@ -554,15 +580,7 @@ static enum type_match_result check_variable(struct data_loc_info *dloc,
>  	else
>  		sized_type = *type_die;
>  
> -	/* Get the size of the actual type */
> -	if (dwarf_aggregate_size(&sized_type, &size) < 0)
> -		return PERF_TMR_NO_SIZE;
> -
> -	/* Minimal sanity check */
> -	if ((unsigned)offset >= size)
> -		return PERF_TMR_BAD_OFFSET;
> -
> -	return PERF_TMR_OK;
> +	return check_type_offset(type_die, offset);
>  }
>  
>  struct type_state_stack *find_stack_state(struct type_state *state,
> @@ -1112,7 +1130,6 @@ static enum type_match_result check_matching_type(struct type_state *state,
>  						  struct disasm_line *dl,
>  						  Dwarf_Die *type_die)
>  {
> -	Dwarf_Word size;
>  	u32 insn_offset = dl->al.offset;
>  	int reg = dloc->op->reg1;
>  	int offset = dloc->op->offset;
> @@ -1166,12 +1183,7 @@ static enum type_match_result check_matching_type(struct type_state *state,
>  		else
>  			sized_type = *type_die;
>  
> -		/* Get the size of the actual type */
> -		if (dwarf_aggregate_size(&sized_type, &size) < 0 ||
> -		    (unsigned)dloc->type_offset >= size)
> -			return PERF_TMR_BAD_OFFSET;
> -
> -		return PERF_TMR_OK;
> +		return check_type_offset(&sized_type, dloc->type_offset);
>  	}
>  
>  	if (state->regs[reg].kind == TSR_KIND_POINTER) {
> @@ -1190,12 +1202,7 @@ static enum type_match_result check_matching_type(struct type_state *state,
>  
>  		dloc->type_offset = dloc->op->offset + state->regs[reg].offset;
>  
> -		/* Get the size of the actual type */
> -		if (dwarf_aggregate_size(type_die, &size) < 0 ||
> -		    (unsigned)dloc->type_offset >= size)
> -			return PERF_TMR_BAD_OFFSET;
> -
> -		return PERF_TMR_OK;
> +		return check_type_offset(type_die, dloc->type_offset);
>  	}
>  
>  	if (state->regs[reg].kind == TSR_KIND_PERCPU_POINTER) {
> @@ -1209,9 +1216,7 @@ static enum type_match_result check_matching_type(struct type_state *state,
>  
>  		dloc->type_offset = dloc->op->offset;
>  
> -		/* Get the size of the actual type */
> -		if (dwarf_aggregate_size(type_die, &size) < 0 ||
> -		    (unsigned)dloc->type_offset >= size)
> +		if (check_type_offset(type_die, dloc->type_offset) != PERF_TMR_OK)
>  			return PERF_TMR_BAIL_OUT;
>  
>  		return PERF_TMR_OK;
> @@ -1839,7 +1844,7 @@ int annotated_data_type__update_samples(struct annotated_data_type *adt,
>  			return -1;
>  	}
>  
> -	if (offset < 0 || offset >= adt->self.size)
> +	if (offset < 0 || (offset >= adt->self.size && !adt->flex_array))
>  		return -1;
>  
>  	h = &adt->histograms[evsel->core.idx];
> diff --git a/tools/perf/util/annotate-data.h b/tools/perf/util/annotate-data.h
> index ca2096a9ee62cbfe..27b7148b64f60350 100644
> --- a/tools/perf/util/annotate-data.h
> +++ b/tools/perf/util/annotate-data.h
> @@ -85,6 +85,7 @@ struct type_hist {
>   * struct annotated_data_type - Data type to profile
>   * @node: RB-tree node for dso->type_tree
>   * @self: Actual type information
> + * @flex_array: Whethere it has a flex array

Nit: typo in the comment -- Whethere should be Whether.

Thanks,
Tengda

>   * @nr_histogram: Number of histogram entries
>   * @histograms: An array of histograms
>   *
> @@ -93,6 +94,7 @@ struct type_hist {
>  struct annotated_data_type {
>  	struct rb_node node;
>  	struct annotated_member self;
> +	bool flex_array;
>  	int nr_histograms;
>  	struct type_hist *histograms;
>  };

Re: [PATCH v2 1/4] perf annotate-data: Convert type histogram to hashmap

[Tengda Wu]

On 2026/9/14 14:45, Namhyung Kim wrote:
> The type histogram maintains sample counts and periods per offset.  Use
> a hashmap instead of an array to reduce the memory overhead.
> 
> No functional changes intended.
> 
> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
> ---
>  tools/perf/ui/browsers/annotate-data.c | 10 ++--
>  tools/perf/util/annotate-data.c        | 72 ++++++++++++++++----------
>  tools/perf/util/annotate-data.h        |  8 +--
>  3 files changed, 57 insertions(+), 33 deletions(-)
> 
> diff --git a/tools/perf/ui/browsers/annotate-data.c b/tools/perf/ui/browsers/annotate-data.c
> index aa8c89fe2e82c1c5..c6e07a9b64089ab5 100644
> --- a/tools/perf/ui/browsers/annotate-data.c
> +++ b/tools/perf/ui/browsers/annotate-data.c
> @@ -62,12 +62,16 @@ static int get_member_overhead(struct annotated_data_type *adt,
>  
>  		k = 0;
>  		for_each_group_evsel(evsel, leader) {
> +			struct type_hist_entry *hist;
> +
>  			if (symbol_conf.skip_empty &&
>  			    evsel__hists(evsel)->stats.nr_samples == 0)
>  				continue;
>  
> -			h = adt->histograms[evsel->core.idx];
> -			update_hist_entry(&entry->hists[k++], &h->addr[offset]);
> +			h = &adt->histograms[evsel->core.idx];
> +			if (hashmap__find(&h->samples, offset, &hist))
> +				update_hist_entry(&entry->hists[k], hist);
> +			k++;
>  		}
>  	}
>  	return 0;
> @@ -416,7 +420,7 @@ static void browser__write(struct ui_browser *uib, void *entry, int row)
>  
>  	/* print the number */
>  	for_each_group_evsel(evsel, leader) {
> -		struct type_hist *h = adt->histograms[evsel->core.idx];
> +		struct type_hist *h = &adt->histograms[evsel->core.idx];
>  
>  		if (symbol_conf.skip_empty &&
>  		    evsel__hists(evsel)->stats.nr_samples == 0)
> diff --git a/tools/perf/util/annotate-data.c b/tools/perf/util/annotate-data.c
> index 4e4c587640823c81..aff60a630fd05b01 100644
> --- a/tools/perf/util/annotate-data.c
> +++ b/tools/perf/util/annotate-data.c
> @@ -1750,42 +1750,45 @@ struct annotated_data_type *find_data_type(struct data_loc_info *dloc)
>  	return dso__findnew_data_type(dso, &type_die);
>  }
>  
> +static size_t data_type_hash(long key, void *ctx __maybe_unused)
> +{
> +	return key;
> +}
> +
> +static bool data_type_equal(long key1, long key2, void *ctx __maybe_unused)
> +{
> +	return key1 == key2;
> +}
> +
>  static int alloc_data_type_histograms(struct annotated_data_type *adt, int nr_entries)
>  {
>  	int i;
> -	size_t sz = sizeof(struct type_hist);
>  
> -	sz += sizeof(struct type_hist_entry) * adt->self.size;
> -
> -	/* Allocate a table of pointers for each event */
> +	/* Allocate a histogram for each event */
>  	adt->histograms = calloc(nr_entries, sizeof(*adt->histograms));
>  	if (adt->histograms == NULL)
>  		return -ENOMEM;
>  
> -	/*
> -	 * Each histogram is allocated for the whole size of the type.
> -	 * TODO: Probably we can move the histogram to members.
> -	 */
>  	for (i = 0; i < nr_entries; i++) {
> -		adt->histograms[i] = zalloc(sz);
> -		if (adt->histograms[i] == NULL)
> -			goto err;
> +		hashmap__init(&adt->histograms[i].samples, data_type_hash,
> +			      data_type_equal, /*ctx=*/NULL);
>  	}
>  
>  	adt->nr_histograms = nr_entries;
>  	return 0;
> -
> -err:
> -	while (--i >= 0)
> -		zfree(&(adt->histograms[i]));
> -	zfree(&adt->histograms);
> -	return -ENOMEM;
>  }
>  
>  static void delete_data_type_histograms(struct annotated_data_type *adt)
>  {
> -	for (int i = 0; i < adt->nr_histograms; i++)
> -		zfree(&(adt->histograms[i]));
> +	for (int i = 0; i < adt->nr_histograms; i++) {
> +		struct hashmap *map = &adt->histograms[i].samples;
> +		struct hashmap_entry *pos, *tmp;
> +		size_t bkt;
> +
> +		hashmap__for_each_entry_safe(map, pos, tmp, bkt)
> +			free(pos->pvalue);
> +		hashmap__clear(map);
> +	}
>  
>  	zfree(&adt->histograms);
>  	adt->nr_histograms = 0;
> @@ -1824,6 +1827,7 @@ int annotated_data_type__update_samples(struct annotated_data_type *adt,
>  					int nr_samples, u64 period)
>  {
>  	struct type_hist *h;
> +	struct type_hist_entry *entry;
>  
>  	if (adt == NULL)
>  		return 0;
> @@ -1838,12 +1842,23 @@ int annotated_data_type__update_samples(struct annotated_data_type *adt,
>  	if (offset < 0 || offset >= adt->self.size)
>  		return -1;
>  
> -	h = adt->histograms[evsel->core.idx];
> +	h = &adt->histograms[evsel->core.idx];
>  
>  	h->nr_samples += nr_samples;
> -	h->addr[offset].nr_samples += nr_samples;
>  	h->period += period;
> -	h->addr[offset].period += period;
> +
> +	if (!hashmap__find(&h->samples, offset, &entry)) {
> +		entry = zalloc(sizeof(*entry));
> +		if (entry == NULL)
> +			return -1;
> +
> +		if (hashmap__append(&h->samples, offset, entry) < 0) {
> +			free(entry);
> +			return -1;
> +		}
> +	}
> +	entry->nr_samples += nr_samples;
> +	entry->period += period;
>  	return 0;
>  }
>  
> @@ -1911,14 +1926,14 @@ static void print_annotated_data_type(struct annotated_data_type *mem_type,
>  				      struct evsel *evsel, int indent)
>  {
>  	struct annotated_member *child;
> -	struct type_hist *h = mem_type->histograms[evsel->core.idx];
> +	struct type_hist *h;
>  	int i, nr_events = 0, samples = 0;
>  	u64 period = 0;
>  	int width = symbol_conf.show_total_period ? 11 : 7;
>  	struct evsel *pos;
>  
>  	for_each_group_evsel(pos, evsel) {
> -		h = mem_type->histograms[pos->core.idx];
> +		h = &mem_type->histograms[pos->core.idx];
>  
>  		if (symbol_conf.skip_empty &&
>  		    evsel__hists(pos)->stats.nr_samples == 0)
> @@ -1927,8 +1942,13 @@ static void print_annotated_data_type(struct annotated_data_type *mem_type,
>  		samples = 0;
>  		period = 0;
>  		for (i = 0; i < member->size; i++) {
> -			samples += h->addr[member->offset + i].nr_samples;
> -			period += h->addr[member->offset + i].period;
> +			struct type_hist_entry *entry;
> +
> +			if (!hashmap__find(&h->samples, member->offset + i, &entry))
> +				continue;
> +
> +			samples += entry->nr_samples;
> +			period += entry->period;
>  		}
>  		print_annotated_data_value(h, period, samples);
>  		nr_events++;
> diff --git a/tools/perf/util/annotate-data.h b/tools/perf/util/annotate-data.h
> index c26130744260955f..ca2096a9ee62cbfe 100644
> --- a/tools/perf/util/annotate-data.h
> +++ b/tools/perf/util/annotate-data.h
> @@ -73,12 +73,12 @@ struct type_hist_entry {
>   * struct type_hist - Type histogram for each event
>   * @nr_samples: Total number of samples in this data type
>   * @period: Total count of the event in this data type
> - * @offset: Array of histogram entry
> + * @samples: Hashmap of (offset, type_hist_entry)
>   */
>  struct type_hist {
>  	u64			nr_samples;
>  	u64			period;
> -	struct type_hist_entry	addr[];
> +	struct hashmap		samples;
>  };
>  
>  /**
> @@ -86,7 +86,7 @@ struct type_hist {
>   * @node: RB-tree node for dso->type_tree
>   * @self: Actual type information
>   * @nr_histogram: Number of histogram entries
> - * @histograms: An array of pointers to histograms
> + * @histograms: An array of histograms
>   *
>   * This represents a data type accessed by samples in the profile data.
>   */
> @@ -94,7 +94,7 @@ struct annotated_data_type {
>  	struct rb_node node;
>  	struct annotated_member self;
>  	int nr_histograms;
> -	struct type_hist **histograms;
> +	struct type_hist *histograms;
>  };
>  
>  extern struct annotated_data_type unknown_type;

Reviewed-by: Tengda Wu <wutengda@huaweicloud.com>

Thanks,
Tengda

Re: [PATCH v2 1/4] perf annotate-data: Convert type histogram to hashmap

[Arnaldo Carvalho de Melo]

On Mon, Sep 14, 2026 at 08:22:06PM +0800, Tengda Wu wrote:
> On 2026/9/14 14:45, Namhyung Kim wrote:
> > The type histogram maintains sample counts and periods per offset.  Use
> > a hashmap instead of an array to reduce the memory overhead.

> > No functional changes intended.
<SNIP>
> > -	struct type_hist **histograms;
> > +	struct type_hist *histograms;
> >  };
 
> >  extern struct annotated_data_type unknown_type;
 
> Reviewed-by: Tengda Wu <wutengda@huaweicloud.com>

I'm cherry picking this first patch, as I'll need to rebase my branch on
top of it and thus testing it as I go developing it, sashiko found no
problems and Tengda reviewed it.

Thanks,

- Arnaldo

Re: [PATCH v2 1/4] perf annotate-data: Convert type histogram to hashmap

[Arnaldo Carvalho de Melo]

On Mon, Sep 14, 2026 at 03:56:35PM -0300, Arnaldo Carvalho de Melo wrote:
> On Mon, Sep 14, 2026 at 08:22:06PM +0800, Tengda Wu wrote:
> > On 2026/9/14 14:45, Namhyung Kim wrote:
> > > The type histogram maintains sample counts and periods per offset.  Use
> > > a hashmap instead of an array to reduce the memory overhead.
> 
> > > No functional changes intended.
> <SNIP>
> > > -	struct type_hist **histograms;
> > > +	struct type_hist *histograms;
> > >  };
>  
> > >  extern struct annotated_data_type unknown_type;
>  
> > Reviewed-by: Tengda Wu <wutengda@huaweicloud.com>
> 
> I'm cherry picking this first patch, as I'll need to rebase my branch on
> top of it and thus testing it as I go developing it, sashiko found no
> problems and Tengda reviewed it.

It is now in tmp.perf-tools-next, will do the usual set of containerized
build tests and push,

- Arnaldo

Re: [PATCH v2 2/4] perf dwarf-aux: Add die_has_flex_array() helper

[Namhyung Kim]

Hello,

On Mon, Sep 14, 2026 at 08:14:56PM +0800, Tengda Wu wrote:
> 
> 
> On 2026/9/14 14:45, Namhyung Kim wrote:
> > The die_has_flex_array() returns true when the given type is a compound
> > type and contains an array at the end.  To prevent an infinite recursion
> > add a depth field to the internal function.
> > 
> > Cc: Masami Hiramatsu <mhiramat@kernel.org>
> > Signed-off-by: Namhyung Kim <namhyung@kernel.org>
> > ---
> >  tools/perf/util/dwarf-aux.c | 77 +++++++++++++++++++++++++++++++++++++
> >  tools/perf/util/dwarf-aux.h |  3 ++
> >  2 files changed, 80 insertions(+)
> > 
> > diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
> > index d7160f87ac7d7ab3..465824e6513eb0ac 100644
> > --- a/tools/perf/util/dwarf-aux.c
> > +++ b/tools/perf/util/dwarf-aux.c
> > @@ -2180,3 +2180,80 @@ Dwarf_Die *die_deref_ptr_type(Dwarf_Die *ptr_die, int offset,
> >  
> >  	return die_get_member_type(&type_die, offset, die_mem);
> >  }
> > +
> > +static bool is_flex_array_member(Dwarf_Die *mb_die)
> > +{
> > +	Dwarf_Die type_die;
> > +	Dwarf_Word size;
> > +
> > +	/* get the type of the member */
> > +	if (die_get_real_type(mb_die, &type_die) == NULL)
> > +		return false;
> > +
> > +	if (dwarf_tag(&type_die) != DW_TAG_array_type)
> > +		return false;
> > +
> > +	return dwarf_aggregate_size(&type_die, &size) < 0 || size == 0;
> > +}
> > +
> > +#define MAX_FLEX_ARRAY_RECURSION  256  /* arbitrary */
> > +
> > +static bool die_has_flex_array_recurse(Dwarf_Die *parent_die, int depth)
> > +{
> > +	Dwarf_Die die_mem, last_mb;
> > +	int tag = dwarf_tag(parent_die);
> > +
> > +	if (tag != DW_TAG_structure_type && tag != DW_TAG_union_type)
> > +		return false;
> > +
> > +	/* prevent infinite recursion */
> > +	if (depth > MAX_FLEX_ARRAY_RECURSION)
> > +		return false;
> > +
> > +	if (dwarf_child(parent_die, &die_mem))
> > +		return false;
> > +
> > +	do {
> > +		if (dwarf_tag(&die_mem) != DW_TAG_member)
> > +			continue;
> > +
> > +		if (tag == DW_TAG_union_type) {
> > +			if (is_flex_array_member(&die_mem))
> > +				return true;
> > +
> > +			if (die_get_real_type(&die_mem, &last_mb) &&
> > +			    die_has_flex_array_recurse(&last_mb, depth + 1))
> > +				return true;
> > +		}
> > +
> > +		if (tag == DW_TAG_structure_type)
> > +			memcpy(&last_mb, &die_mem, sizeof(last_mb));
> > +
> > +	} while (dwarf_siblingof(&die_mem, &die_mem) == 0);
> > +
> > +	if (tag == DW_TAG_structure_type) {
> > +		if (is_flex_array_member(&last_mb))
> 
> Not sure if this case can actually happen, but adding a check for whether
> last_mb is valid is probably better. (I see Sashiko flagged this too.)

Right, will fix in v3.

Thanks for your review!
Namhyung

Re: [PATCH v2 3/4] perf annotate-date: Allow out-of-size access for flex-array types

[Namhyung Kim]

On Mon, Sep 14, 2026 at 07:00:48AM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
> - [Medium] check_variable and check_matching_type fail to pass the typedef-resolved 'sized_type' to 'check_type_offset', causing an unused variable warning and breaking flex-array detection for typedefs.
> - [Medium] Uninitialized stack variable 'last_mb' is used in 'die_has_flex_array_recurse' if a structure contains children but no data members.
> --
> 
> commit cd675d28ffa1b31e0fe343fa27c89e7794eb74ec
> Author: Namhyung Kim <namhyung@kernel.org>
> 
> perf annotate-date: Allow out-of-size access for flex-array types
>     
> Structs that have a flex array will have accesses beyond its original
> size as the array was declared as 0 sized.  For now, it just allow any
> offset bigger than the size.  It could be refined later.
> 
> > diff --git a/tools/perf/util/annotate-data.c b/tools/perf/util/annotate-data.c
> > index aff60a630fd05..e8aff6a916c0a 100644
> > --- a/tools/perf/util/annotate-data.c
> > +++ b/tools/perf/util/annotate-data.c
> 
> [ ... ]
> 
> > @@ -399,6 +407,7 @@ static struct annotated_data_type *dso__findnew_data_type(struct dso *dso,
> >  	result->self.type_name = type_name;
> >  	result->self.size = size;
> >  	INIT_LIST_HEAD(&result->self.children);
> > +	result->flex_array = die_has_flex_array(type_die);
> 
> [Severity: Medium]
> Will this call into die_has_flex_array_recurse() trigger an uninitialized
> stack variable access for empty structures?
> 
> If the structure has child DIEs but none of them are DW_TAG_member, the
> last_mb variable won't be assigned in the loop, leaving it uninitialized
> when evaluated:
> 
> tools/perf/util/dwarf-aux.c:die_has_flex_array_recurse() {
> 	Dwarf_Die die_mem, last_mb;
> ...
> 	do {
> 		if (dwarf_tag(&die_mem) != DW_TAG_member)
> 			continue;
> ...
> 		if (tag == DW_TAG_structure_type)
> 			memcpy(&last_mb, &die_mem, sizeof(last_mb));
> 
> 	} while (dwarf_siblingof(&die_mem, &die_mem) == 0);
> 
> 	if (tag == DW_TAG_structure_type) {
> 		if (is_flex_array_member(&last_mb))
> 			return true;
> ...
> 
> Should last_mb be initialized, or should we track whether it was set before
> calling is_flex_array_member()?

Will fix.

> 
> >  
> >  	if (symbol_conf.annotate_data_member)
> >  		add_member_types(result, type_die);
> 
> [ ... ]
> 
> > @@ -554,15 +580,7 @@ static enum type_match_result check_variable(struct data_loc_info *dloc,
> >  	else
> >  		sized_type = *type_die;
> >  
> > -	/* Get the size of the actual type */
> > -	if (dwarf_aggregate_size(&sized_type, &size) < 0)
> > -		return PERF_TMR_NO_SIZE;
> > -
> > -	/* Minimal sanity check */
> > -	if ((unsigned)offset >= size)
> > -		return PERF_TMR_BAD_OFFSET;
> > -
> > -	return PERF_TMR_OK;
> > +	return check_type_offset(type_die, offset);
> >  }
> 
> [Severity: Medium]
> Should this pass &sized_type instead of type_die?
> 
> Passing type_die ignores the typedef resolution performed earlier in this
> function and leaves sized_type completely unused. Since check_type_offset()
> now evaluates die_has_flex_array(type_die), this might break flex-array
> detection for types hidden behind typedefs.

Oops, that's right.  Will fix.

> 
> [ ... ]
> 
> > @@ -1190,12 +1202,7 @@ static enum type_match_result check_matching_type(struct type_state *state,
> >  
> >  		dloc->type_offset = dloc->op->offset + state->regs[reg].offset;
> >  
> > -		/* Get the size of the actual type */
> > -		if (dwarf_aggregate_size(type_die, &size) < 0 ||
> > -		    (unsigned)dloc->type_offset >= size)
> > -			return PERF_TMR_BAD_OFFSET;
> > -
> > -		return PERF_TMR_OK;
> > +		return check_type_offset(type_die, dloc->type_offset);
> >  	}
> 
> [Severity: Medium]
> For pointer types here, should type_die also be stripped of typedefs before
> checking the type offset?
> 
> Similar to the logic used for TSR_KIND_TYPE, flex-arrays might go undetected
> if they are hidden behind unresolved typedefs.

This may be a valid concern but doesn't belong to this change.  Probably
I can check and fix separately later.

Thanks,
Namhyung

Re: [PATCH v2 4/4] perf annotate-data: Adjust type offset for flex-array

[Namhyung Kim]

On Mon, Sep 14, 2026 at 07:01:04AM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
> - [Medium] Off-by-one error and tail padding overlap in flex-array offset adjustment causes accesses to be silently dropped and incorrectly attributed.
> - [Medium] Calling `strstr()` on `child->type_name` without checking for NULL causes a segmentation fault if memory allocation failed during type name extraction.
> - [Medium] The newly added `strstr(child->type_name, "[]")` call reads uninitialized heap memory, leading to out-of-bounds reads and potential crashes when analyzing malformed or unknown DWARF entries.
> --
> 
> commit 546415e2740f53443f133b3600542636f3d84f31
> Author: Namhyung Kim <namhyung@kernel.org>
> perf annotate-data: Adjust type offset for flex-array
> 
> This commit adjusts the type offset for flexible array members that are located
> beyond the original type size. It ensures a field name is found for flex arrays
> by adjusting the offset in an array to find a corresponding element.
> 
> > diff --git a/tools/perf/util/annotate-data.c b/tools/perf/util/annotate-data.c
> > index e8aff6a916c0a..a66b72feb6e2f 100644
> > --- a/tools/perf/util/annotate-data.c
> > +++ b/tools/perf/util/annotate-data.c
> 
> [ ... ]
> 
> > @@ -355,15 +376,37 @@ static int fill_member_name(char *buf, size_t sz, struct annotated_member *m,
> >  			len = 0;
> >  		}
> >  
> > -		return fill_member_name(buf + len, sz - len, child, offset, first) + len;
> > +		return fill_member_name(buf + len, sz - len, child, offset, first,
> > +					has_flex_array) + len;
> >  	}
> > +
> >  	return 0;
> >  }
> >  
> >  int annotated_data_type__get_member_name(struct annotated_data_type *adt,
> >  					 char *buf, size_t sz, int member_offset)
> >  {
> > -	return fill_member_name(buf, sz, &adt->self, member_offset, /*first=*/true);
> > +	return fill_member_name(buf, sz, &adt->self, member_offset, /*first=*/true,
> > +				adt->flex_array);
> > +}
> > +
> > +static struct annotated_member *find_flex_array(struct annotated_member *m)
> > +{
> > +	struct annotated_member *child;
> > +
> > +	if (list_empty(&m->children))
> > +		return NULL;
> > +
> > +	child = list_last_entry(&m->children, struct annotated_member, node);
> > +	if (strstr(child->type_name, "[]"))
> 
> [Severity: Medium]
> Could this call to strstr() safely handle scenarios where child->type_name is
> NULL or uninitialized?
> 
> During DWARF parsing, for instance in __add_member_cb(), if die_get_typename()
> fails due to a malformed DWARF entry or memory exhaustion, strbuf_detach()
> might return an uninitialized heap buffer or NULL. If that happens, does this
> scan risk triggering a segmentation fault or an out-of-bounds read when looking
> for the "[]" string?

Ok, will check.

> 
> > +		return child;
> > +
> > +	return find_flex_array(child);
> > +}
> 
> [ ... ]
> 
> > @@ -1740,6 +1783,7 @@ struct annotated_data_type *find_data_type(struct data_loc_info *dloc)
> >  {
> >  	struct dso *dso = map__dso(dloc->ms->map);
> >  	Dwarf_Die type_die;
> > +	struct annotated_data_type *result;
> >  
> >  	/*
> >  	 * The type offset is the same as instruction offset by default.
> > @@ -1752,7 +1796,25 @@ struct annotated_data_type *find_data_type(struct data_loc_info *dloc)
> >  	if (find_data_type_die(dloc, &type_die) < 0)
> >  		return NULL;
> >  
> > -	return dso__findnew_data_type(dso, &type_die);
> > +	result = dso__findnew_data_type(dso, &type_die);
> > +	if (result == NULL)
> > +		return NULL;
> > +
> > +	if (result->flex_array && dloc->type_offset > result->self.size) {
> 
> [Severity: Medium]
> Will this boundary check correctly catch accesses that fall exactly on the
> boundary or within the struct's tail padding?
> 
> If an event samples a flexible array element whose offset is greater than 
> flex_array->offset but less than or equal to result->self.size (the total
> padded size of the struct), it appears this condition evaluates to false.
> Could this cause the offset adjustment to be skipped, causing valid sample
> counts to be silently dropped during data presentation?

I think it's ok.  If it's less than or equal to result->self.size, it'd
have high chances to fall into the flex array element so I think they
will be processed properly without adjusting the offset.

Basically this adjustment is to improve visualization of the member
name.  It won't to drop samples anyway.

Thanks,
Namhyung

> 
> > +		struct annotated_member *flex_array = get_flex_array_member(result);
> > +
> > +		if (flex_array && flex_array->size > 0) {
> > +			int offset = dloc->type_offset;
> > +
> > +			/* adjust offset in the flex array */
> > +			offset -= flex_array->offset;
> > +			offset %= flex_array->size;
> > +			offset += flex_array->offset;
> > +
> > +			dloc->type_offset = offset;
> > +		}
> > +	}
> > +	return result;
> >  }
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20260914064535.1671939-1-namhyung@kernel.org?part=4

Re: [PATCH v2 3/4] perf annotate-date: Allow out-of-size access for flex-array types

[Namhyung Kim]

On Mon, Sep 14, 2026 at 08:19:44PM +0800, Tengda Wu wrote:
> 
> 
> On 2026/9/14 14:45, Namhyung Kim wrote:
> > Structs that have a flex array will have accesses beyond its original
> > size as the array was declared as 0 sized.  For now, it just allow any
> > offset bigger than the size.  It could be refined later.
> > 
> > Signed-off-by: Namhyung Kim <namhyung@kernel.org>
> > ---
> >  tools/perf/util/annotate-data.c | 63 ++++++++++++++++++---------------
> >  tools/perf/util/annotate-data.h |  2 ++
> >  2 files changed, 36 insertions(+), 29 deletions(-)
> > 
> > diff --git a/tools/perf/util/annotate-data.c b/tools/perf/util/annotate-data.c
> > index aff60a630fd05b01..e8aff6a916c0afe0 100644
> > --- a/tools/perf/util/annotate-data.c
> > +++ b/tools/perf/util/annotate-data.c
> > @@ -7,6 +7,7 @@
> >  #include <errno.h>
> >  #include <stdio.h>
> >  #include <stdlib.h>
> > +#include <string.h>
> >  #include <inttypes.h>
> >  #include <linux/zalloc.h>
> >  
> > @@ -248,8 +249,15 @@ static int __add_member_cb(Dwarf_Die *die, void *arg)
> >  	else
> >  		die_mem = member_type;
> >  
> > -	if (dwarf_aggregate_size(&die_mem, &size) < 0)
> > -		size = 0;
> > +	if (dwarf_aggregate_size(&die_mem, &size) < 0) {
> > +		if (dwarf_tag(&die_mem) == DW_TAG_array_type) { /* flex-array? */
> > +			die_get_real_type(&die_mem, &die_mem);
> > +			if (dwarf_aggregate_size(&die_mem, &size) < 0)
> > +				size = 0;
> > +		} else {
> > +			size = 0;
> > +		}
> > +	}
> >  
> >  	if (dwarf_attr_integrate(die, DW_AT_data_member_location, &attr)) {
> >  		if (dwarf_formudata(&attr, &loc) != 0) {
> > @@ -399,6 +407,7 @@ static struct annotated_data_type *dso__findnew_data_type(struct dso *dso,
> >  	result->self.type_name = type_name;
> >  	result->self.size = size;
> >  	INIT_LIST_HEAD(&result->self.children);
> > +	result->flex_array = die_has_flex_array(type_die);
> >  
> >  	if (symbol_conf.annotate_data_member)
> >  		add_member_types(result, type_die);
> > @@ -517,13 +526,30 @@ static bool is_better_type(Dwarf_Die *type_a, Dwarf_Die *type_b)
> >  	return false;
> >  }
> >  
> > +static enum type_match_result check_type_offset(Dwarf_Die *type_die, int offset)
> > +{
> > +	Dwarf_Word size;
> > +
> > +	/* Get the size of the actual type */
> > +	if (dwarf_aggregate_size(type_die, &size) < 0)
> > +		return PERF_TMR_NO_SIZE;
> > +
> > +	/* Minimal sanity check */
> > +	if (offset < 0)
> > +		return PERF_TMR_BAD_OFFSET;
> > +
> > +	if ((unsigned)offset >= size && !die_has_flex_array(type_die))
> > +		return PERF_TMR_BAD_OFFSET;
> > +
> > +	return PERF_TMR_OK;
> > +}
> > +
> >  /* The type info will be saved in @type_die */
> >  static enum type_match_result check_variable(struct data_loc_info *dloc,
> >  					     Dwarf_Die *var_die,
> >  					     Dwarf_Die *type_die, int reg,
> >  					     int offset, bool is_fbreg)
> >  {
> > -	Dwarf_Word size;
> >  	bool needs_pointer = true;
> >  	Dwarf_Die sized_type;
> >  
> > @@ -554,15 +580,7 @@ static enum type_match_result check_variable(struct data_loc_info *dloc,
> >  	else
> >  		sized_type = *type_die;
> >  
> > -	/* Get the size of the actual type */
> > -	if (dwarf_aggregate_size(&sized_type, &size) < 0)
> > -		return PERF_TMR_NO_SIZE;
> > -
> > -	/* Minimal sanity check */
> > -	if ((unsigned)offset >= size)
> > -		return PERF_TMR_BAD_OFFSET;
> > -
> > -	return PERF_TMR_OK;
> > +	return check_type_offset(type_die, offset);
> >  }
> >  
> >  struct type_state_stack *find_stack_state(struct type_state *state,
> > @@ -1112,7 +1130,6 @@ static enum type_match_result check_matching_type(struct type_state *state,
> >  						  struct disasm_line *dl,
> >  						  Dwarf_Die *type_die)
> >  {
> > -	Dwarf_Word size;
> >  	u32 insn_offset = dl->al.offset;
> >  	int reg = dloc->op->reg1;
> >  	int offset = dloc->op->offset;
> > @@ -1166,12 +1183,7 @@ static enum type_match_result check_matching_type(struct type_state *state,
> >  		else
> >  			sized_type = *type_die;
> >  
> > -		/* Get the size of the actual type */
> > -		if (dwarf_aggregate_size(&sized_type, &size) < 0 ||
> > -		    (unsigned)dloc->type_offset >= size)
> > -			return PERF_TMR_BAD_OFFSET;
> > -
> > -		return PERF_TMR_OK;
> > +		return check_type_offset(&sized_type, dloc->type_offset);
> >  	}
> >  
> >  	if (state->regs[reg].kind == TSR_KIND_POINTER) {
> > @@ -1190,12 +1202,7 @@ static enum type_match_result check_matching_type(struct type_state *state,
> >  
> >  		dloc->type_offset = dloc->op->offset + state->regs[reg].offset;
> >  
> > -		/* Get the size of the actual type */
> > -		if (dwarf_aggregate_size(type_die, &size) < 0 ||
> > -		    (unsigned)dloc->type_offset >= size)
> > -			return PERF_TMR_BAD_OFFSET;
> > -
> > -		return PERF_TMR_OK;
> > +		return check_type_offset(type_die, dloc->type_offset);
> >  	}
> >  
> >  	if (state->regs[reg].kind == TSR_KIND_PERCPU_POINTER) {
> > @@ -1209,9 +1216,7 @@ static enum type_match_result check_matching_type(struct type_state *state,
> >  
> >  		dloc->type_offset = dloc->op->offset;
> >  
> > -		/* Get the size of the actual type */
> > -		if (dwarf_aggregate_size(type_die, &size) < 0 ||
> > -		    (unsigned)dloc->type_offset >= size)
> > +		if (check_type_offset(type_die, dloc->type_offset) != PERF_TMR_OK)
> >  			return PERF_TMR_BAIL_OUT;
> >  
> >  		return PERF_TMR_OK;
> > @@ -1839,7 +1844,7 @@ int annotated_data_type__update_samples(struct annotated_data_type *adt,
> >  			return -1;
> >  	}
> >  
> > -	if (offset < 0 || offset >= adt->self.size)
> > +	if (offset < 0 || (offset >= adt->self.size && !adt->flex_array))
> >  		return -1;
> >  
> >  	h = &adt->histograms[evsel->core.idx];
> > diff --git a/tools/perf/util/annotate-data.h b/tools/perf/util/annotate-data.h
> > index ca2096a9ee62cbfe..27b7148b64f60350 100644
> > --- a/tools/perf/util/annotate-data.h
> > +++ b/tools/perf/util/annotate-data.h
> > @@ -85,6 +85,7 @@ struct type_hist {
> >   * struct annotated_data_type - Data type to profile
> >   * @node: RB-tree node for dso->type_tree
> >   * @self: Actual type information
> > + * @flex_array: Whethere it has a flex array
> 
> Nit: typo in the comment -- Whethere should be Whether.

Will fix.

Thanks,
Namhyung

Re: [PATCH v2 1/4] perf annotate-data: Convert type histogram to hashmap

[Namhyung Kim]

On Mon, Sep 14, 2026 at 04:22:54PM -0300, Arnaldo Carvalho de Melo wrote:
> On Mon, Sep 14, 2026 at 03:56:35PM -0300, Arnaldo Carvalho de Melo wrote:
> > On Mon, Sep 14, 2026 at 08:22:06PM +0800, Tengda Wu wrote:
> > > On 2026/9/14 14:45, Namhyung Kim wrote:
> > > > The type histogram maintains sample counts and periods per offset.  Use
> > > > a hashmap instead of an array to reduce the memory overhead.
> > 
> > > > No functional changes intended.
> > <SNIP>
> > > > -	struct type_hist **histograms;
> > > > +	struct type_hist *histograms;
> > > >  };
> >  
> > > >  extern struct annotated_data_type unknown_type;
> >  
> > > Reviewed-by: Tengda Wu <wutengda@huaweicloud.com>
> > 
> > I'm cherry picking this first patch, as I'll need to rebase my branch on
> > top of it and thus testing it as I go developing it, sashiko found no
> > problems and Tengda reviewed it.
> 
> It is now in tmp.perf-tools-next, will do the usual set of containerized
> build tests and push,

Thanks a lot, Arnaldo!

Namhyung

Re: [PATCH v2 2/4] perf dwarf-aux: Add die_has_flex_array() helper

[Masami Hiramatsu]

On Sun, 13 Sep 2026 23:45:33 -0700
Namhyung Kim <namhyung@kernel.org> wrote:

> The die_has_flex_array() returns true when the given type is a compound
> type and contains an array at the end.  To prevent an infinite recursion
> add a depth field to the internal function.

Hi, thanks for this nice extension!
BTW, I have a comment on this implementation.

> 
> Cc: Masami Hiramatsu <mhiramat@kernel.org>
> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
> ---
>  tools/perf/util/dwarf-aux.c | 77 +++++++++++++++++++++++++++++++++++++
>  tools/perf/util/dwarf-aux.h |  3 ++
>  2 files changed, 80 insertions(+)
> 
> diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
> index d7160f87ac7d7ab3..465824e6513eb0ac 100644
> --- a/tools/perf/util/dwarf-aux.c
> +++ b/tools/perf/util/dwarf-aux.c
> @@ -2180,3 +2180,80 @@ Dwarf_Die *die_deref_ptr_type(Dwarf_Die *ptr_die, int offset,
>  
>  	return die_get_member_type(&type_die, offset, die_mem);
>  }
> +
> +static bool is_flex_array_member(Dwarf_Die *mb_die)
> +{
> +	Dwarf_Die type_die;
> +	Dwarf_Word size;
> +
> +	/* get the type of the member */
> +	if (die_get_real_type(mb_die, &type_die) == NULL)
> +		return false;
> +
> +	if (dwarf_tag(&type_die) != DW_TAG_array_type)
> +		return false;
> +
> +	return dwarf_aggregate_size(&type_die, &size) < 0 || size == 0;
> +}
> +
> +#define MAX_FLEX_ARRAY_RECURSION  256  /* arbitrary */
> +
> +static bool die_has_flex_array_recurse(Dwarf_Die *parent_die, int depth)
> +{
> +	Dwarf_Die die_mem, last_mb;
> +	int tag = dwarf_tag(parent_die);
> +
> +	if (tag != DW_TAG_structure_type && tag != DW_TAG_union_type)
> +		return false;

What happen if the parent_die is "typedef struct {..." ?
I think you need to use die_get_real_type() here. ;)

> +
> +	/* prevent infinite recursion */
> +	if (depth > MAX_FLEX_ARRAY_RECURSION)
> +		return false;
> +
> +	if (dwarf_child(parent_die, &die_mem))
> +		return false;
> +
> +	do {
> +		if (dwarf_tag(&die_mem) != DW_TAG_member)
> +			continue;

If the member is a "const" member, you may have to use
die_get_real_type() to get the actual type.
(in this case, you need a cursor DIE for dwarf_siblingof()) 

> +
> +		if (tag == DW_TAG_union_type) {
> +			if (is_flex_array_member(&die_mem))
> +				return true;
> +
> +			if (die_get_real_type(&die_mem, &last_mb) &&
> +			    die_has_flex_array_recurse(&last_mb, depth + 1))
> +				return true;
> +		}
> +
> +		if (tag == DW_TAG_structure_type)
> +			memcpy(&last_mb, &die_mem, sizeof(last_mb));

To find the last member, I think you'd better check the
DW_AT_data_member_location and DW_AT_decl_line to ensure the
DIE is the last member.

Thank you,


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>

Re: [PATCH v2 2/4] perf dwarf-aux: Add die_has_flex_array() helper

[Namhyung Kim]

Hi Masami,

On Tue, Sep 15, 2026 at 08:40:48AM +0900, Masami Hiramatsu wrote:
> On Sun, 13 Sep 2026 23:45:33 -0700
> Namhyung Kim <namhyung@kernel.org> wrote:
> 
> > The die_has_flex_array() returns true when the given type is a compound
> > type and contains an array at the end.  To prevent an infinite recursion
> > add a depth field to the internal function.
> 
> Hi, thanks for this nice extension!
> BTW, I have a comment on this implementation.

Thanks for your review!

> 
> > 
> > Cc: Masami Hiramatsu <mhiramat@kernel.org>
> > Signed-off-by: Namhyung Kim <namhyung@kernel.org>
> > ---
> >  tools/perf/util/dwarf-aux.c | 77 +++++++++++++++++++++++++++++++++++++
> >  tools/perf/util/dwarf-aux.h |  3 ++
> >  2 files changed, 80 insertions(+)
> > 
> > diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
> > index d7160f87ac7d7ab3..465824e6513eb0ac 100644
> > --- a/tools/perf/util/dwarf-aux.c
> > +++ b/tools/perf/util/dwarf-aux.c
> > @@ -2180,3 +2180,80 @@ Dwarf_Die *die_deref_ptr_type(Dwarf_Die *ptr_die, int offset,
> >  
> >  	return die_get_member_type(&type_die, offset, die_mem);
> >  }
> > +
> > +static bool is_flex_array_member(Dwarf_Die *mb_die)
> > +{
> > +	Dwarf_Die type_die;
> > +	Dwarf_Word size;
> > +
> > +	/* get the type of the member */
> > +	if (die_get_real_type(mb_die, &type_die) == NULL)
> > +		return false;
> > +
> > +	if (dwarf_tag(&type_die) != DW_TAG_array_type)
> > +		return false;
> > +
> > +	return dwarf_aggregate_size(&type_die, &size) < 0 || size == 0;
> > +}
> > +
> > +#define MAX_FLEX_ARRAY_RECURSION  256  /* arbitrary */
> > +
> > +static bool die_has_flex_array_recurse(Dwarf_Die *parent_die, int depth)
> > +{
> > +	Dwarf_Die die_mem, last_mb;
> > +	int tag = dwarf_tag(parent_die);
> > +
> > +	if (tag != DW_TAG_structure_type && tag != DW_TAG_union_type)
> > +		return false;
> 
> What happen if the parent_die is "typedef struct {..." ?
> I think you need to use die_get_real_type() here. ;)

Currently I expect callers to do it before calling.  But probably I can
add it to the outer function.

> 
> > +
> > +	/* prevent infinite recursion */
> > +	if (depth > MAX_FLEX_ARRAY_RECURSION)
> > +		return false;
> > +
> > +	if (dwarf_child(parent_die, &die_mem))
> > +		return false;
> > +
> > +	do {
> > +		if (dwarf_tag(&die_mem) != DW_TAG_member)
> > +			continue;
> 
> If the member is a "const" member, you may have to use
> die_get_real_type() to get the actual type.
> (in this case, you need a cursor DIE for dwarf_siblingof()) 

Doesn't it belong to a type of the member?  In my simple test program,
it shows the struct type only has children of members and their types
including const are referenced from the member DIEs.

Also I don't think flexible arrays will be const as they cannot be
initialized.

> 
> > +
> > +		if (tag == DW_TAG_union_type) {
> > +			if (is_flex_array_member(&die_mem))
> > +				return true;
> > +
> > +			if (die_get_real_type(&die_mem, &last_mb) &&
> > +			    die_has_flex_array_recurse(&last_mb, depth + 1))
> > +				return true;
> > +		}
> > +
> > +		if (tag == DW_TAG_structure_type)
> > +			memcpy(&last_mb, &die_mem, sizeof(last_mb));
> 
> To find the last member, I think you'd better check the
> DW_AT_data_member_location and DW_AT_decl_line to ensure the
> DIE is the last member.

Good point.  I can add the member location check.  I'm afraid decl line
may be incorrect if compiler randomized the layout.

So far I haven't seen DWARF data having unsorted members (by location),
but it'd be better to make sure it's sorted.

Thanks,
Namhyung

Re: [PATCH v2 2/4] perf dwarf-aux: Add die_has_flex_array() helper

[Masami Hiramatsu]

On Mon, 14 Sep 2026 22:54:19 -0700
Namhyung Kim <namhyung@kernel.org> wrote:

> > > +
> > > +	do {
> > > +		if (dwarf_tag(&die_mem) != DW_TAG_member)
> > > +			continue;
> > 
> > If the member is a "const" member, you may have to use
> > die_get_real_type() to get the actual type.
> > (in this case, you need a cursor DIE for dwarf_siblingof()) 
> 
> Doesn't it belong to a type of the member?  In my simple test program,
> it shows the struct type only has children of members and their types
> including const are referenced from the member DIEs.
> 
> Also I don't think flexible arrays will be const as they cannot be
> initialized.

Ah, indeed. flex array needs to be initialized. :)

> 
> > 
> > > +
> > > +		if (tag == DW_TAG_union_type) {
> > > +			if (is_flex_array_member(&die_mem))
> > > +				return true;
> > > +
> > > +			if (die_get_real_type(&die_mem, &last_mb) &&
> > > +			    die_has_flex_array_recurse(&last_mb, depth + 1))
> > > +				return true;
> > > +		}
> > > +
> > > +		if (tag == DW_TAG_structure_type)
> > > +			memcpy(&last_mb, &die_mem, sizeof(last_mb));
> > 
> > To find the last member, I think you'd better check the
> > DW_AT_data_member_location and DW_AT_decl_line to ensure the
> > DIE is the last member.
> 
> Good point.  I can add the member location check.  I'm afraid decl line
> may be incorrect if compiler randomized the layout.
> 
> So far I haven't seen DWARF data having unsorted members (by location),
> but it'd be better to make sure it's sorted.

OK, that maybe enough.

Thanks!


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>