Re: [PATCH v8 3/5] tracing: Add stackmap statistics interface

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] tracing: undercounted fallbacks in ftrace_stackmap_get_cookie()
  on pool race
--

commit 668d6dcc7b8dc107b88cd7cdf37f1ed69e5f66bc
Author: Pengfei Li <lipengfei28@xiaomi.com>

tracing: Add stackmap statistics interface

This commit adds a tracefs stack_map_stat file and per-CPU counters to
report stackmap generation, capacity, element usage, and lookup successes
and fallbacks.

> diff --git a/kernel/trace/trace_stackmap.c b/kernel/trace/trace_stackmap.c
> index b02eb22c76a98..5d2a406f39b93 100644
> --- a/kernel/trace/trace_stackmap.c
> +++ b/kernel/trace/trace_stackmap.c

[ ... ]

> @@ -254,8 +276,10 @@ bool ftrace_stackmap_get_cookie(struct ftrace_stackmap *smap,
>  		probes++;
>  	}
>  
> +	stackmap_count(smap->fallbacks);
>  	return false;
>  found:
> +	stackmap_count(smap->successes);
>  	*cookie = ((u64)smap->generation << FTRACE_STACKMAP_COOKIE_GEN_SHIFT) | idx;
>  	return true;
>  }

[Severity: Low]
Can ftrace_stackmap_get_cookie() undercount smap->fallbacks when the
element pool runs out during a concurrent insert?

When two CPUs pass the smap->next_elt < smap->max_elts check for the last
available element, both claim an entry->key slot via cmpxchg(), and
stackmap_get_elt() returns NULL for the loser:

kernel/trace/trace_stackmap.c:ftrace_stackmap_get_cookie() {
    ...
		if (test_key == key_hash) {
			val = stackmap_load_elt(entry);
			/* Insert in progress; from NMI it may be the interrupted one. */
			if (!val)
				return false;
    ...
		} else if (!test_key) {
			if (atomic_read(&smap->next_elt) >= smap->max_elts)
				break;
			/* Lost the race; the slot may now hold this stack. */
			if (cmpxchg(&entry->key, 0, key_hash) != 0)
				continue;

			val = stackmap_get_elt(smap);
			if (!val)
				break;
    ...
}

That leaves entry->key set to key_hash with entry->val still NULL.  Every
subsequent lookup for that stack (or any stack with the same key_hash
probing through that slot) then hits test_key == key_hash, sees !val, and
returns false early without incrementing smap->fallbacks.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261107055139.3138633-1-lipengfei28@xiaomi.com?part=3