[PATCH v1 1/2] perf/core: Include attr.defer_output in is_sb_event()

[PATCH v1 1/2] perf/core: Include attr.defer_output in is_sb_event()

[Ian Rogers]

Events configured with attr.defer_output = 1 receive deferred callchain
sideband records (PERF_RECORD_CALLCHAIN_DEFERRED) via perf_iterate_sb().
Include attr->defer_output in is_sb_event() so that such events are
attached to the sideband event list even when no other sideband flags
(such as mmap or comm) are enabled on the event.

Fixes: c69993ecdd4d ("perf: Support deferred user unwind")
Signed-off-by: Ian Rogers <irogers@google.com>
---
 kernel/events/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index c4217c996f5a..b43883a42566 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -5347,7 +5347,7 @@ static bool is_sb_event(struct perf_event *event)
 	    attr->comm || attr->comm_exec ||
 	    attr->task || attr->ksymbol ||
 	    attr->context_switch || attr->text_poke ||
-	    attr->bpf_event)
+	    attr->bpf_event || attr->defer_output)
 		return true;
 
 	return false;
-- 
2.56.0.307.g5fe7bd680c-goog

[PATCH v1 2/2] perf/core: Clamp deferred callchain entry count to fit u16 header.size

[Ian Rogers]

In perf_callchain_deferred_output(), if trace->nr is large enough that
sizeof(deferred_event->event) + trace->nr * sizeof(u64) + id_header_size
exceeds U16_MAX, header.size wraps while the output loop still writes
all trace->nr entries into the ring buffer. Clamp nr per event (accounting
for event->id_header_size when sample_id_all is enabled) so the record
never overflows u16 header.size.

Fixes: c69993ecdd4d ("perf: Support deferred user unwind")
Signed-off-by: Ian Rogers <irogers@google.com>
---
 kernel/events/core.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index b43883a42566..37824ca7fe97 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -10385,8 +10385,6 @@ struct perf_callchain_deferred_event {
 	struct {
 		struct perf_event_header	header;
 		u64				cookie;
-		u64				nr;
-		u64				ips[];
 	} event;
 };
 
@@ -10395,12 +10393,19 @@ static void perf_callchain_deferred_output(struct perf_event *event, void *data)
 	struct perf_callchain_deferred_event *deferred_event = data;
 	struct perf_output_handle handle;
 	struct perf_sample_data sample;
+	u64 nr = deferred_event->trace->nr;
+	u16 size, id_size, max_payload;
 	int ret;
-	u16 size = sizeof(deferred_event->event) + (deferred_event->trace->nr * sizeof(u64));
 
 	if (!event->attr.defer_output)
 		return;
 
+	id_size = event->attr.sample_id_all ? event->id_header_size : 0;
+	max_payload = round_down(U16_MAX - sizeof(deferred_event->event) -
+				 sizeof(u64) - id_size, sizeof(u64));
+	nr = min_t(u64, nr, max_payload / sizeof(u64));
+	size = sizeof(deferred_event->event) + sizeof(u64) + nr * sizeof(u64);
+
 	/* XXX do we really need sample_id_all for this ??? */
 	perf_event_header__init(&deferred_event->event.header, &sample,
 				PERF_RECORD_CALLCHAIN_DEFERRED,
@@ -10414,8 +10419,10 @@ static void perf_callchain_deferred_output(struct perf_event *event, void *data)
 		return;
 
 	perf_output_put(&handle, deferred_event->event);
-	for (int i = 0; i < deferred_event->trace->nr; i++) {
+	perf_output_put(&handle, nr);
+	for (u64 i = 0; i < nr; i++) {
 		u64 entry = deferred_event->trace->entries[i];
+
 		perf_output_put(&handle, entry);
 	}
 	perf_event__output_id_sample(event, &handle, &sample);
@@ -10430,7 +10437,6 @@ static void perf_unwind_deferred_callback(struct unwind_work *work,
 		.trace = trace,
 		.event = {
 			.cookie = cookie,
-			.nr = trace->nr,
 		},
 	};
 
-- 
2.56.0.307.g5fe7bd680c-goog

Re: [PATCH v1 2/2] perf/core: Clamp deferred callchain entry count to fit u16 header.size

[Ian Rogers]

On Sun, Oct 25, 2026 at 2:55 PM Ian Rogers <irogers@google.com> wrote:
>
> In perf_callchain_deferred_output(), if trace->nr is large enough that
> sizeof(deferred_event->event) + trace->nr * sizeof(u64) + id_header_size
> exceeds U16_MAX, header.size wraps while the output loop still writes
> all trace->nr entries into the ring buffer. Clamp nr per event (accounting
> for event->id_header_size when sample_id_all is enabled) so the record
> never overflows u16 header.size.
>
> Fixes: c69993ecdd4d ("perf: Support deferred user unwind")
> Signed-off-by: Ian Rogers <irogers@google.com>

Ping. +Steve and Masami

Thanks,
Ian

> ---
>  kernel/events/core.c | 16 +++++++++++-----
>  1 file changed, 11 insertions(+), 5 deletions(-)
>
> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index b43883a42566..37824ca7fe97 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -10385,8 +10385,6 @@ struct perf_callchain_deferred_event {
>         struct {
>                 struct perf_event_header        header;
>                 u64                             cookie;
> -               u64                             nr;
> -               u64                             ips[];
>         } event;
>  };
>
> @@ -10395,12 +10393,19 @@ static void perf_callchain_deferred_output(struct perf_event *event, void *data)
>         struct perf_callchain_deferred_event *deferred_event = data;
>         struct perf_output_handle handle;
>         struct perf_sample_data sample;
> +       u64 nr = deferred_event->trace->nr;
> +       u16 size, id_size, max_payload;
>         int ret;
> -       u16 size = sizeof(deferred_event->event) + (deferred_event->trace->nr * sizeof(u64));
>
>         if (!event->attr.defer_output)
>                 return;
>
> +       id_size = event->attr.sample_id_all ? event->id_header_size : 0;
> +       max_payload = round_down(U16_MAX - sizeof(deferred_event->event) -
> +                                sizeof(u64) - id_size, sizeof(u64));
> +       nr = min_t(u64, nr, max_payload / sizeof(u64));
> +       size = sizeof(deferred_event->event) + sizeof(u64) + nr * sizeof(u64);
> +
>         /* XXX do we really need sample_id_all for this ??? */
>         perf_event_header__init(&deferred_event->event.header, &sample,
>                                 PERF_RECORD_CALLCHAIN_DEFERRED,
> @@ -10414,8 +10419,10 @@ static void perf_callchain_deferred_output(struct perf_event *event, void *data)
>                 return;
>
>         perf_output_put(&handle, deferred_event->event);
> -       for (int i = 0; i < deferred_event->trace->nr; i++) {
> +       perf_output_put(&handle, nr);
> +       for (u64 i = 0; i < nr; i++) {
>                 u64 entry = deferred_event->trace->entries[i];
> +
>                 perf_output_put(&handle, entry);
>         }
>         perf_event__output_id_sample(event, &handle, &sample);
> @@ -10430,7 +10437,6 @@ static void perf_unwind_deferred_callback(struct unwind_work *work,
>                 .trace = trace,
>                 .event = {
>                         .cookie = cookie,
> -                       .nr = trace->nr,
>                 },
>         };
>
> --
> 2.56.0.307.g5fe7bd680c-goog
>

[tip: perf/urgent] perf/core: Clamp deferred callchain entry count to fit u16 header.size

[tip-bot2 for Ian Rogers]

The following commit has been merged into the perf/urgent branch of tip:

Commit-ID:     5e4d83fb3616ebf807df1ce1b0ee7a8cdcb5ff87
Gitweb:        https://git.kernel.org/tip/5e4d83fb3616ebf807df1ce1b0ee7a8cdcb5ff87
Author:        Ian Rogers <irogers@google.com>
AuthorDate:    Sun, 25 Oct 2026 14:55:08 -07:00
Committer:     Ingo Molnar <mingo@kernel.org>
CommitterDate: Fri, 06 Nov 2026 09:39:43 +01:00

perf/core: Clamp deferred callchain entry count to fit u16 header.size

In perf_callchain_deferred_output(), if trace->nr is large enough that
sizeof(deferred_event->event) + trace->nr * sizeof(u64) + id_header_size
exceeds U16_MAX, header.size wraps while the output loop still writes
all trace->nr entries into the ring buffer.

Clamp nr per event (accounting for event->id_header_size when
sample_id_all is enabled) so the record never overflows u16 header.size.

Fixes: c69993ecdd4d ("perf: Support deferred user unwind")
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Link: https://patch.msgid.link/20261025215508.1237480-2-irogers@google.com
---
 kernel/events/core.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 6cbd701..580590b 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -10514,8 +10514,6 @@ struct perf_callchain_deferred_event {
 	struct {
 		struct perf_event_header	header;
 		u64				cookie;
-		u64				nr;
-		u64				ips[];
 	} event;
 };
 
@@ -10524,12 +10522,19 @@ static void perf_callchain_deferred_output(struct perf_event *event, void *data)
 	struct perf_callchain_deferred_event *deferred_event = data;
 	struct perf_output_handle handle;
 	struct perf_sample_data sample;
+	u64 nr = deferred_event->trace->nr;
+	u16 size, id_size, max_payload;
 	int ret;
-	u16 size = sizeof(deferred_event->event) + (deferred_event->trace->nr * sizeof(u64));
 
 	if (!event->attr.defer_output)
 		return;
 
+	id_size = event->attr.sample_id_all ? event->id_header_size : 0;
+	max_payload = round_down(U16_MAX - sizeof(deferred_event->event) -
+				 sizeof(u64) - id_size, sizeof(u64));
+	nr = min_t(u64, nr, max_payload / sizeof(u64));
+	size = sizeof(deferred_event->event) + sizeof(u64) + nr * sizeof(u64);
+
 	/* XXX do we really need sample_id_all for this ??? */
 	perf_event_header__init(&deferred_event->event.header, &sample,
 				PERF_RECORD_CALLCHAIN_DEFERRED,
@@ -10543,8 +10548,10 @@ static void perf_callchain_deferred_output(struct perf_event *event, void *data)
 		return;
 
 	perf_output_put(&handle, deferred_event->event);
-	for (int i = 0; i < deferred_event->trace->nr; i++) {
+	perf_output_put(&handle, nr);
+	for (u64 i = 0; i < nr; i++) {
 		u64 entry = deferred_event->trace->entries[i];
+
 		perf_output_put(&handle, entry);
 	}
 	perf_event__output_id_sample(event, &handle, &sample);
@@ -10559,7 +10566,6 @@ static void perf_unwind_deferred_callback(struct unwind_work *work,
 		.trace = trace,
 		.event = {
 			.cookie = cookie,
-			.nr = trace->nr,
 		},
 	};
 

Re: [PATCH v1 1/2] perf/core: Include attr.defer_output in is_sb_event()

[Ian Rogers]

On Sun, Oct 25, 2026 at 2:55 PM Ian Rogers <irogers@google.com> wrote:
>
> Events configured with attr.defer_output = 1 receive deferred callchain
> sideband records (PERF_RECORD_CALLCHAIN_DEFERRED) via perf_iterate_sb().
> Include attr->defer_output in is_sb_event() so that such events are
> attached to the sideband event list even when no other sideband flags
> (such as mmap or comm) are enabled on the event.
>
> Fixes: c69993ecdd4d ("perf: Support deferred user unwind")
> Signed-off-by: Ian Rogers <irogers@google.com>

Ping. +Steve and Masami

Thanks,
Ian

> ---
>  kernel/events/core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index c4217c996f5a..b43883a42566 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -5347,7 +5347,7 @@ static bool is_sb_event(struct perf_event *event)
>             attr->comm || attr->comm_exec ||
>             attr->task || attr->ksymbol ||
>             attr->context_switch || attr->text_poke ||
> -           attr->bpf_event)
> +           attr->bpf_event || attr->defer_output)
>                 return true;
>
>         return false;
> --
> 2.56.0.307.g5fe7bd680c-goog
>

[tip: perf/urgent] perf/core: Include perf_event_attr::defer_output in is_sb_event() check

[tip-bot2 for Ian Rogers]

The following commit has been merged into the perf/urgent branch of tip:

Commit-ID:     772f38fc69d5cf22f13b43dec30c2bbc5bdf4eb8
Gitweb:        https://git.kernel.org/tip/772f38fc69d5cf22f13b43dec30c2bbc5bdf4eb8
Author:        Ian Rogers <irogers@google.com>
AuthorDate:    Sun, 25 Oct 2026 14:55:07 -07:00
Committer:     Ingo Molnar <mingo@kernel.org>
CommitterDate: Fri, 06 Nov 2026 09:38:16 +01:00

perf/core: Include perf_event_attr::defer_output in is_sb_event() check

Events configured with attr.defer_output = 1 receive deferred callchain
sideband records (PERF_RECORD_CALLCHAIN_DEFERRED) via perf_iterate_sb().

Include attr->defer_output in is_sb_event() so that such events are
attached to the sideband event list even when no other sideband flags
(such as mmap or comm) are enabled on the event.

Fixes: c69993ecdd4d ("perf: Support deferred user unwind")
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Link: https://patch.msgid.link/20261025215508.1237480-1-irogers@google.com
---
 kernel/events/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 457d75e..6cbd701 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -5356,7 +5356,7 @@ static bool is_sb_event(struct perf_event *event)
 	    attr->comm || attr->comm_exec ||
 	    attr->task || attr->ksymbol ||
 	    attr->context_switch || attr->text_poke ||
-	    attr->bpf_event)
+	    attr->bpf_event || attr->defer_output)
 		return true;
 
 	return false;