* [PATCH v1 1/2] perf/core: Include attr.defer_output in is_sb_event()
@ 2026-10-25 21:55 Ian Rogers
2026-10-25 21:55 ` [PATCH v1 2/2] perf/core: Clamp deferred callchain entry count to fit u16 header.size Ian Rogers
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Ian Rogers @ 2026-10-25 21:55 UTC (permalink / raw)
To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Namhyung Kim, Mark Rutland, Alexander Shishkin, Jiri Olsa,
Ian Rogers, Adrian Hunter, James Clark, linux-perf-users,
linux-kernel, bpf
Events configured with attr.defer_output = 1 receive deferred callchain
sideband records (PERF_RECORD_CALLCHAIN_DEFERRED) via perf_iterate_sb().
Include attr->defer_output in is_sb_event() so that such events are
attached to the sideband event list even when no other sideband flags
(such as mmap or comm) are enabled on the event.
Fixes: c69993ecdd4d ("perf: Support deferred user unwind")
Signed-off-by: Ian Rogers <irogers@google.com>
---
kernel/events/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/events/core.c b/kernel/events/core.c
index c4217c996f5a..b43883a42566 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -5347,7 +5347,7 @@ static bool is_sb_event(struct perf_event *event)
attr->comm || attr->comm_exec ||
attr->task || attr->ksymbol ||
attr->context_switch || attr->text_poke ||
- attr->bpf_event)
+ attr->bpf_event || attr->defer_output)
return true;
return false;
--
2.56.0.307.g5fe7bd680c-goog
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH v1 2/2] perf/core: Clamp deferred callchain entry count to fit u16 header.size
2026-10-25 21:55 [PATCH v1 1/2] perf/core: Include attr.defer_output in is_sb_event() Ian Rogers
@ 2026-10-25 21:55 ` Ian Rogers
2026-11-04 4:25 ` Ian Rogers
2026-11-06 9:50 ` [tip: perf/urgent] " tip-bot2 for Ian Rogers
2026-11-04 4:23 ` [PATCH v1 1/2] perf/core: Include attr.defer_output in is_sb_event() Ian Rogers
2026-11-06 9:50 ` [tip: perf/urgent] perf/core: Include perf_event_attr::defer_output in is_sb_event() check tip-bot2 for Ian Rogers
2 siblings, 2 replies; 6+ messages in thread
From: Ian Rogers @ 2026-10-25 21:55 UTC (permalink / raw)
To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Namhyung Kim, Mark Rutland, Alexander Shishkin, Jiri Olsa,
Ian Rogers, Adrian Hunter, James Clark, linux-perf-users,
linux-kernel, bpf
In perf_callchain_deferred_output(), if trace->nr is large enough that
sizeof(deferred_event->event) + trace->nr * sizeof(u64) + id_header_size
exceeds U16_MAX, header.size wraps while the output loop still writes
all trace->nr entries into the ring buffer. Clamp nr per event (accounting
for event->id_header_size when sample_id_all is enabled) so the record
never overflows u16 header.size.
Fixes: c69993ecdd4d ("perf: Support deferred user unwind")
Signed-off-by: Ian Rogers <irogers@google.com>
---
kernel/events/core.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/kernel/events/core.c b/kernel/events/core.c
index b43883a42566..37824ca7fe97 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -10385,8 +10385,6 @@ struct perf_callchain_deferred_event {
struct {
struct perf_event_header header;
u64 cookie;
- u64 nr;
- u64 ips[];
} event;
};
@@ -10395,12 +10393,19 @@ static void perf_callchain_deferred_output(struct perf_event *event, void *data)
struct perf_callchain_deferred_event *deferred_event = data;
struct perf_output_handle handle;
struct perf_sample_data sample;
+ u64 nr = deferred_event->trace->nr;
+ u16 size, id_size, max_payload;
int ret;
- u16 size = sizeof(deferred_event->event) + (deferred_event->trace->nr * sizeof(u64));
if (!event->attr.defer_output)
return;
+ id_size = event->attr.sample_id_all ? event->id_header_size : 0;
+ max_payload = round_down(U16_MAX - sizeof(deferred_event->event) -
+ sizeof(u64) - id_size, sizeof(u64));
+ nr = min_t(u64, nr, max_payload / sizeof(u64));
+ size = sizeof(deferred_event->event) + sizeof(u64) + nr * sizeof(u64);
+
/* XXX do we really need sample_id_all for this ??? */
perf_event_header__init(&deferred_event->event.header, &sample,
PERF_RECORD_CALLCHAIN_DEFERRED,
@@ -10414,8 +10419,10 @@ static void perf_callchain_deferred_output(struct perf_event *event, void *data)
return;
perf_output_put(&handle, deferred_event->event);
- for (int i = 0; i < deferred_event->trace->nr; i++) {
+ perf_output_put(&handle, nr);
+ for (u64 i = 0; i < nr; i++) {
u64 entry = deferred_event->trace->entries[i];
+
perf_output_put(&handle, entry);
}
perf_event__output_id_sample(event, &handle, &sample);
@@ -10430,7 +10437,6 @@ static void perf_unwind_deferred_callback(struct unwind_work *work,
.trace = trace,
.event = {
.cookie = cookie,
- .nr = trace->nr,
},
};
--
2.56.0.307.g5fe7bd680c-goog
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v1 1/2] perf/core: Include attr.defer_output in is_sb_event()
2026-10-25 21:55 [PATCH v1 1/2] perf/core: Include attr.defer_output in is_sb_event() Ian Rogers
2026-10-25 21:55 ` [PATCH v1 2/2] perf/core: Clamp deferred callchain entry count to fit u16 header.size Ian Rogers
@ 2026-11-04 4:23 ` Ian Rogers
2026-11-06 9:50 ` [tip: perf/urgent] perf/core: Include perf_event_attr::defer_output in is_sb_event() check tip-bot2 for Ian Rogers
2 siblings, 0 replies; 6+ messages in thread
From: Ian Rogers @ 2026-11-04 4:23 UTC (permalink / raw)
To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Namhyung Kim, Mark Rutland, Alexander Shishkin, Jiri Olsa,
Ian Rogers, Adrian Hunter, James Clark, linux-perf-users,
linux-kernel, bpf, Masami Hiramatsu, Steven Rostedt
On Sun, Oct 25, 2026 at 2:55 PM Ian Rogers <irogers@google.com> wrote:
>
> Events configured with attr.defer_output = 1 receive deferred callchain
> sideband records (PERF_RECORD_CALLCHAIN_DEFERRED) via perf_iterate_sb().
> Include attr->defer_output in is_sb_event() so that such events are
> attached to the sideband event list even when no other sideband flags
> (such as mmap or comm) are enabled on the event.
>
> Fixes: c69993ecdd4d ("perf: Support deferred user unwind")
> Signed-off-by: Ian Rogers <irogers@google.com>
Ping. +Steve and Masami
Thanks,
Ian
> ---
> kernel/events/core.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index c4217c996f5a..b43883a42566 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -5347,7 +5347,7 @@ static bool is_sb_event(struct perf_event *event)
> attr->comm || attr->comm_exec ||
> attr->task || attr->ksymbol ||
> attr->context_switch || attr->text_poke ||
> - attr->bpf_event)
> + attr->bpf_event || attr->defer_output)
> return true;
>
> return false;
> --
> 2.56.0.307.g5fe7bd680c-goog
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v1 2/2] perf/core: Clamp deferred callchain entry count to fit u16 header.size
2026-10-25 21:55 ` [PATCH v1 2/2] perf/core: Clamp deferred callchain entry count to fit u16 header.size Ian Rogers
@ 2026-11-04 4:25 ` Ian Rogers
2026-11-06 9:50 ` [tip: perf/urgent] " tip-bot2 for Ian Rogers
1 sibling, 0 replies; 6+ messages in thread
From: Ian Rogers @ 2026-11-04 4:25 UTC (permalink / raw)
To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Namhyung Kim, Mark Rutland, Alexander Shishkin, Jiri Olsa,
Ian Rogers, Adrian Hunter, James Clark, linux-perf-users,
linux-kernel, bpf, Masami Hiramatsu, Steven Rostedt
On Sun, Oct 25, 2026 at 2:55 PM Ian Rogers <irogers@google.com> wrote:
>
> In perf_callchain_deferred_output(), if trace->nr is large enough that
> sizeof(deferred_event->event) + trace->nr * sizeof(u64) + id_header_size
> exceeds U16_MAX, header.size wraps while the output loop still writes
> all trace->nr entries into the ring buffer. Clamp nr per event (accounting
> for event->id_header_size when sample_id_all is enabled) so the record
> never overflows u16 header.size.
>
> Fixes: c69993ecdd4d ("perf: Support deferred user unwind")
> Signed-off-by: Ian Rogers <irogers@google.com>
Ping. +Steve and Masami
Thanks,
Ian
> ---
> kernel/events/core.c | 16 +++++++++++-----
> 1 file changed, 11 insertions(+), 5 deletions(-)
>
> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index b43883a42566..37824ca7fe97 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -10385,8 +10385,6 @@ struct perf_callchain_deferred_event {
> struct {
> struct perf_event_header header;
> u64 cookie;
> - u64 nr;
> - u64 ips[];
> } event;
> };
>
> @@ -10395,12 +10393,19 @@ static void perf_callchain_deferred_output(struct perf_event *event, void *data)
> struct perf_callchain_deferred_event *deferred_event = data;
> struct perf_output_handle handle;
> struct perf_sample_data sample;
> + u64 nr = deferred_event->trace->nr;
> + u16 size, id_size, max_payload;
> int ret;
> - u16 size = sizeof(deferred_event->event) + (deferred_event->trace->nr * sizeof(u64));
>
> if (!event->attr.defer_output)
> return;
>
> + id_size = event->attr.sample_id_all ? event->id_header_size : 0;
> + max_payload = round_down(U16_MAX - sizeof(deferred_event->event) -
> + sizeof(u64) - id_size, sizeof(u64));
> + nr = min_t(u64, nr, max_payload / sizeof(u64));
> + size = sizeof(deferred_event->event) + sizeof(u64) + nr * sizeof(u64);
> +
> /* XXX do we really need sample_id_all for this ??? */
> perf_event_header__init(&deferred_event->event.header, &sample,
> PERF_RECORD_CALLCHAIN_DEFERRED,
> @@ -10414,8 +10419,10 @@ static void perf_callchain_deferred_output(struct perf_event *event, void *data)
> return;
>
> perf_output_put(&handle, deferred_event->event);
> - for (int i = 0; i < deferred_event->trace->nr; i++) {
> + perf_output_put(&handle, nr);
> + for (u64 i = 0; i < nr; i++) {
> u64 entry = deferred_event->trace->entries[i];
> +
> perf_output_put(&handle, entry);
> }
> perf_event__output_id_sample(event, &handle, &sample);
> @@ -10430,7 +10437,6 @@ static void perf_unwind_deferred_callback(struct unwind_work *work,
> .trace = trace,
> .event = {
> .cookie = cookie,
> - .nr = trace->nr,
> },
> };
>
> --
> 2.56.0.307.g5fe7bd680c-goog
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* [tip: perf/urgent] perf/core: Clamp deferred callchain entry count to fit u16 header.size
2026-10-25 21:55 ` [PATCH v1 2/2] perf/core: Clamp deferred callchain entry count to fit u16 header.size Ian Rogers
2026-11-04 4:25 ` Ian Rogers
@ 2026-11-06 9:50 ` tip-bot2 for Ian Rogers
1 sibling, 0 replies; 6+ messages in thread
From: tip-bot2 for Ian Rogers @ 2026-11-06 9:50 UTC (permalink / raw)
To: linux-tip-commits
Cc: Ian Rogers, Peter Zijlstra (Intel), Ingo Molnar, x86,
linux-kernel
The following commit has been merged into the perf/urgent branch of tip:
Commit-ID: 5e4d83fb3616ebf807df1ce1b0ee7a8cdcb5ff87
Gitweb: https://git.kernel.org/tip/5e4d83fb3616ebf807df1ce1b0ee7a8cdcb5ff87
Author: Ian Rogers <irogers@google.com>
AuthorDate: Sun, 25 Oct 2026 14:55:08 -07:00
Committer: Ingo Molnar <mingo@kernel.org>
CommitterDate: Fri, 06 Nov 2026 09:39:43 +01:00
perf/core: Clamp deferred callchain entry count to fit u16 header.size
In perf_callchain_deferred_output(), if trace->nr is large enough that
sizeof(deferred_event->event) + trace->nr * sizeof(u64) + id_header_size
exceeds U16_MAX, header.size wraps while the output loop still writes
all trace->nr entries into the ring buffer.
Clamp nr per event (accounting for event->id_header_size when
sample_id_all is enabled) so the record never overflows u16 header.size.
Fixes: c69993ecdd4d ("perf: Support deferred user unwind")
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Link: https://patch.msgid.link/20261025215508.1237480-2-irogers@google.com
---
kernel/events/core.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 6cbd701..580590b 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -10514,8 +10514,6 @@ struct perf_callchain_deferred_event {
struct {
struct perf_event_header header;
u64 cookie;
- u64 nr;
- u64 ips[];
} event;
};
@@ -10524,12 +10522,19 @@ static void perf_callchain_deferred_output(struct perf_event *event, void *data)
struct perf_callchain_deferred_event *deferred_event = data;
struct perf_output_handle handle;
struct perf_sample_data sample;
+ u64 nr = deferred_event->trace->nr;
+ u16 size, id_size, max_payload;
int ret;
- u16 size = sizeof(deferred_event->event) + (deferred_event->trace->nr * sizeof(u64));
if (!event->attr.defer_output)
return;
+ id_size = event->attr.sample_id_all ? event->id_header_size : 0;
+ max_payload = round_down(U16_MAX - sizeof(deferred_event->event) -
+ sizeof(u64) - id_size, sizeof(u64));
+ nr = min_t(u64, nr, max_payload / sizeof(u64));
+ size = sizeof(deferred_event->event) + sizeof(u64) + nr * sizeof(u64);
+
/* XXX do we really need sample_id_all for this ??? */
perf_event_header__init(&deferred_event->event.header, &sample,
PERF_RECORD_CALLCHAIN_DEFERRED,
@@ -10543,8 +10548,10 @@ static void perf_callchain_deferred_output(struct perf_event *event, void *data)
return;
perf_output_put(&handle, deferred_event->event);
- for (int i = 0; i < deferred_event->trace->nr; i++) {
+ perf_output_put(&handle, nr);
+ for (u64 i = 0; i < nr; i++) {
u64 entry = deferred_event->trace->entries[i];
+
perf_output_put(&handle, entry);
}
perf_event__output_id_sample(event, &handle, &sample);
@@ -10559,7 +10566,6 @@ static void perf_unwind_deferred_callback(struct unwind_work *work,
.trace = trace,
.event = {
.cookie = cookie,
- .nr = trace->nr,
},
};
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [tip: perf/urgent] perf/core: Include perf_event_attr::defer_output in is_sb_event() check
2026-10-25 21:55 [PATCH v1 1/2] perf/core: Include attr.defer_output in is_sb_event() Ian Rogers
2026-10-25 21:55 ` [PATCH v1 2/2] perf/core: Clamp deferred callchain entry count to fit u16 header.size Ian Rogers
2026-11-04 4:23 ` [PATCH v1 1/2] perf/core: Include attr.defer_output in is_sb_event() Ian Rogers
@ 2026-11-06 9:50 ` tip-bot2 for Ian Rogers
2 siblings, 0 replies; 6+ messages in thread
From: tip-bot2 for Ian Rogers @ 2026-11-06 9:50 UTC (permalink / raw)
To: linux-tip-commits
Cc: Ian Rogers, Peter Zijlstra (Intel), Ingo Molnar, x86,
linux-kernel
The following commit has been merged into the perf/urgent branch of tip:
Commit-ID: 772f38fc69d5cf22f13b43dec30c2bbc5bdf4eb8
Gitweb: https://git.kernel.org/tip/772f38fc69d5cf22f13b43dec30c2bbc5bdf4eb8
Author: Ian Rogers <irogers@google.com>
AuthorDate: Sun, 25 Oct 2026 14:55:07 -07:00
Committer: Ingo Molnar <mingo@kernel.org>
CommitterDate: Fri, 06 Nov 2026 09:38:16 +01:00
perf/core: Include perf_event_attr::defer_output in is_sb_event() check
Events configured with attr.defer_output = 1 receive deferred callchain
sideband records (PERF_RECORD_CALLCHAIN_DEFERRED) via perf_iterate_sb().
Include attr->defer_output in is_sb_event() so that such events are
attached to the sideband event list even when no other sideband flags
(such as mmap or comm) are enabled on the event.
Fixes: c69993ecdd4d ("perf: Support deferred user unwind")
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Link: https://patch.msgid.link/20261025215508.1237480-1-irogers@google.com
---
kernel/events/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 457d75e..6cbd701 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -5356,7 +5356,7 @@ static bool is_sb_event(struct perf_event *event)
attr->comm || attr->comm_exec ||
attr->task || attr->ksymbol ||
attr->context_switch || attr->text_poke ||
- attr->bpf_event)
+ attr->bpf_event || attr->defer_output)
return true;
return false;
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-11-06 9:50 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-25 21:55 [PATCH v1 1/2] perf/core: Include attr.defer_output in is_sb_event() Ian Rogers
2026-10-25 21:55 ` [PATCH v1 2/2] perf/core: Clamp deferred callchain entry count to fit u16 header.size Ian Rogers
2026-11-04 4:25 ` Ian Rogers
2026-11-06 9:50 ` [tip: perf/urgent] " tip-bot2 for Ian Rogers
2026-11-04 4:23 ` [PATCH v1 1/2] perf/core: Include attr.defer_output in is_sb_event() Ian Rogers
2026-11-06 9:50 ` [tip: perf/urgent] perf/core: Include perf_event_attr::defer_output in is_sb_event() check tip-bot2 for Ian Rogers
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox