linux-stable.git/tools/perf/util/event.c, branch linux-rolling-stable

perf tools: Use perf_env__get_cpu_topology() in machine__resolve()

2026-07-24T14:20:08+00:00

[ Upstream commit 5484b43a0ec8231c36fba6ead654cb72dbba8b8f ]

machine__resolve() accesses env->cpu[al->cpu].socket_id after checking
al->cpu >= 0 and env->cpu != NULL, but without validating al->cpu
against env->nr_cpus_avail.  Since al->cpu comes from the untrusted
perf.data sample, a crafted file with a large CPU index causes an
out-of-bounds heap read.

Use perf_env__get_cpu_topology() which validates both NULL and bounds.
Also bounds-check al->cpu before the cast to struct perf_cpu (int16_t):
without this, values like 65536 silently truncate to 0, bypassing the
accessor's internal check and returning CPU 0's topology.

Fixes: 0c4c4debb0adda4c ("perf tools: Add processor socket info to hist_entry and addr_location")
Reported-by: sashiko-bot 
Reviewed-by: Ian Rogers 
Cc: Kan Liang 
Cc: Ian Rogers 
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Sasha Levin

perf tools: Use calloc() where applicable

2026-04-09T02:21:05+00:00

Instead of using zalloc(nr_entries * sizeof_entry) that is what calloc()
does.

In some places where linux/zalloc.h isn't needed, remove it, add when
needed and was getting it indirectly.

Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Namhyung Kim

perf map_symbol: Switch from holding maps to holding thread

2026-01-23T19:58:39+00:00

maps may belong to >1 thread. In contexts like symbolization
information from the thread may be useful, such as the ELF machine.

As the maps can be gained from the thread switch from holding maps in
struct map_symbol to holding the thread.

Holding the maps in addr_location is also redundant, switch this to
using thread__maps.

Reviewed-by: James Clark 
Signed-off-by: Ian Rogers 
Cc: Aditya Bodkhe 
Cc: Adrian Hunter 
Cc: Albert Ou 
Cc: Alexander Shishkin 
Cc: Alexandre Ghiti 
Cc: Athira Rajeev 
Cc: Bill Wendling 
Cc: Dr. David Alan Gilbert 
Cc: Guo Ren 
Cc: Howard Chu 
Cc: Ingo Molnar 
Cc: Jiri Olsa 
Cc: John Garry 
Cc: Julia Lawall 
Cc: Justin Stitt 
Cc: Krzysztof Łopatowski 
Cc: Leo Yan 
Cc: Namhyung Kim 
Cc: Nathan Chancellor 
Cc: Nick Desaulniers 
Cc: Palmer Dabbelt 
Cc: Paul Walmsley 
Cc: Peter Zijlstra 
Cc: Sergei Trofimovich 
Cc: Shimin Guo 
Cc: Suchit Karunakaran 
Cc: Thomas Falcon 
Cc: Tianyou Li 
Cc: Will Deacon 
Cc: Zecheng Li 
Signed-off-by: Arnaldo Carvalho de Melo

perf sched stats: Add schedstat v17 support

2026-01-22T15:31:51+00:00

The /proc/schedstat file output is standardized with version number.

Add support to record and raw dump v17 version layout.

Version 17 of schedstats removed 'lb_imbalance' field as it has no
significance anymore and instead added more relevant fields namely
'lb_imbalance_load', 'lb_imbalance_util', 'lb_imbalance_task' and
'lb_imbalance_misfit'.

The domain field prints the name of the corresponding sched domain from
this version onwards.

Co-developed-by: Ravi Bangoria 
Signed-off-by: Ravi Bangoria 
Signed-off-by: Swapnil Sapkal 
Tested-by: Chen Yu 
Acked-by: Ian Rogers 
Acked-by: Peter Zijlstra 
Cc: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Andi Kleen 
Cc: Anubhav Shelat 
Cc: Ben Gainey 
Cc: Blake Jones 
Cc: Chun-Tse Shao 
Cc: David Vernet 
Cc: Dmitriy Vyukov 
Cc: Dr. David Alan Gilbert 
Cc: Gautham Shenoy 
Cc: Graham Woodward 
Cc: Ingo Molnar 
Cc: James Clark 
Cc: Jiri Olsa 
Cc: Juri Lelli 
Cc: K Prateek Nayak 
Cc: Kan Liang 
Cc: Leo Yan 
Cc: Madadi Vineeth Reddy 
Cc: Mark Rutland 
Cc: Namhyung Kim 
Cc: Sandipan Das 
Cc: Santosh Shukla 
Cc: Shrikanth Hegde 
Cc: Steven Rostedt (VMware) 
Cc: Tejun Heo 
Cc: Thomas Falcon 
Cc: Tim Chen 
Cc: Vincent Guittot 
Cc: Yang Jihong 
Cc: Yujie Liu 
Cc: Zhongqiu Han 
Signed-off-by: Arnaldo Carvalho de Melo

perf sched stats: Add schedstat v16 support

2026-01-22T15:30:16+00:00

The /proc/schedstat file output is standardized with version number.

Add support to record and raw dump v16 version layout.

Version 16 of schedstats changed the order of definitions within 'enum
cpu_idle_type', which changed the order of [CPU_MAX_IDLE_TYPES] columns
in show_schedstat().

In particular the position of CPU_IDLE and __CPU_NOT_IDLE changed
places.

Co-developed-by: Ravi Bangoria 
Signed-off-by: Ravi Bangoria 
Signed-off-by: Swapnil Sapkal 
Tested-by: Chen Yu 
Tested-by: James Clark 
Acked-by: Ian Rogers 
Acked-by: Peter Zijlstra 
Cc: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Andi Kleen 
Cc: Anubhav Shelat 
Cc: Ben Gainey 
Cc: Blake Jones 
Cc: Chun-Tse Shao 
Cc: David Vernet 
Cc: Dmitriy Vyukov 
Cc: Dr. David Alan Gilbert 
Cc: Gautham Shenoy 
Cc: Graham Woodward 
Cc: Ingo Molnar 
Cc: James Clark 
Cc: Jiri Olsa 
Cc: Juri Lelli 
Cc: K Prateek Nayak 
Cc: Kan Liang 
Cc: Leo Yan 
Cc: Madadi Vineeth Reddy 
Cc: Mark Rutland 
Cc: Namhyung Kim 
Cc: Sandipan Das 
Cc: Santosh Shukla 
Cc: Shrikanth Hegde 
Cc: Steven Rostedt (VMware) 
Cc: Tejun Heo 
Cc: Thomas Falcon 
Cc: Tim Chen 
Cc: Vincent Guittot 
Cc: Yang Jihong 
Cc: Yujie Liu 
Cc: Zhongqiu Han 
Signed-off-by: Arnaldo Carvalho de Melo

perf sched stats: Add record and rawdump support

2026-01-22T15:29:28+00:00

Define new, perf tool only, sample types and their layouts. Add logic
to parse /proc/schedstat, convert it to perf sample format and save
samples to perf.data file with `perf sched stats record` command.

Also add logic to read perf.data file, interpret schedstat samples and
print rawdump of samples with `perf script -D`.

Note that, /proc/schedstat file output is standardized with version
number. The patch supports v15 but older or newer version can be added
easily.

Co-developed-by: Ravi Bangoria 
Signed-off-by: Ravi Bangoria 
Signed-off-by: Swapnil Sapkal 
Tested-by: Chen Yu 
Tested-by: James Clark 
Acked-by: Ian Rogers 
Acked-by: Peter Zijlstra 
Cc: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Andi Kleen 
Cc: Anubhav Shelat 
Cc: Ben Gainey 
Cc: Blake Jones 
Cc: Chun-Tse Shao 
Cc: David Vernet 
Cc: Dmitriy Vyukov 
Cc: Dr. David Alan Gilbert 
Cc: Gautham Shenoy 
Cc: Graham Woodward 
Cc: Ingo Molnar 
Cc: James Clark 
Cc: Jiri Olsa 
Cc: Juri Lelli 
Cc: K Prateek Nayak 
Cc: Kan Liang 
Cc: Leo Yan 
Cc: Madadi Vineeth Reddy 
Cc: Mark Rutland 
Cc: Namhyung Kim 
Cc: Sandipan Das 
Cc: Santosh Shukla 
Cc: Shrikanth Hegde 
Cc: Steven Rostedt (VMware) 
Cc: Tejun Heo 
Cc: Thomas Falcon 
Cc: Tim Chen 
Cc: Vincent Guittot 
Cc: Yang Jihong 
Cc: Yujie Liu 
Cc: Zhongqiu Han 
[ PRIu64 needs uint64_t, not 'unsigned long' to work on both 32-bit and 64-bit ]
Signed-off-by: Arnaldo Carvalho de Melo

perf tools: Minimal DEFERRED_CALLCHAIN support

2025-12-03T00:13:32+00:00

Add a new event type for deferred callchains and a new callback for the
struct perf_tool.  For now it doesn't actually handle the deferred
callchains but it just marks the sample if it has the PERF_CONTEXT_
USER_DEFFERED in the callchain array.

At least, perf report can dump the raw data with this change.  Actually
this requires the next commit to enable attr.defer_callchain, but if you
already have a data file, it'll show the following result.

  $ perf report -D
  ...
  0x2158@perf.data [0x40]: event: 22
  .
  . ... raw event: size 64 bytes
  .  0000:  16 00 00 00 02 00 40 00 06 00 00 00 0b 00 00 00  ......@.........
  .  0010:  03 00 00 00 00 00 00 00 a7 7f 33 fe 18 7f 00 00  ..........3.....
  .  0020:  0f 0e 33 fe 18 7f 00 00 48 14 33 fe 18 7f 00 00  ..3.....H.3.....
  .  0030:  08 09 00 00 08 09 00 00 e6 7a e7 35 1c 00 00 00  .........z.5....

  121163447014 0x2158 [0x40]: PERF_RECORD_CALLCHAIN_DEFERRED(IP, 0x2): 2312/2312: 0xb00000006
  ... FP chain: nr:3
  .....  0: 00007f18fe337fa7
  .....  1: 00007f18fe330e0f
  .....  2: 00007f18fe331448
  : unhandled!

Reviewed-by: Ian Rogers 
Signed-off-by: Namhyung Kim

perf build-id: Change sprintf functions to snprintf

2025-07-25T17:37:13+00:00

Pass in a size argument rather than implying all build id strings must
be SBUILD_ID_SIZE.

Signed-off-by: Ian Rogers 
Link: https://lore.kernel.org/r/20250724163302.596743-4-irogers@google.com
[ fixed some build errors ]
Signed-off-by: Namhyung Kim

perf tools: display the new PERF_RECORD_BPF_METADATA event

2025-06-20T21:48:56+00:00

Here's some example "perf script -D" output for the new event type. The
": unhandled!" message is from tool.c, analogous to other behavior there.
I've elided some rows with all NUL characters for brevity, and I wrapped
one of the >75-column lines to fit in the commit guidelines.

0x50fc8@perf.data [0x260]: event: 84
.
. ... raw event: size 608 bytes
.  0000:  54 00 00 00 00 00 60 02 62 70 66 5f 70 72 6f 67  T.....`.bpf_prog
.  0010:  5f 31 65 30 61 32 65 33 36 36 65 35 36 66 31 61  _1e0a2e366e56f1a
.  0020:  32 5f 70 65 72 66 5f 73 61 6d 70 6c 65 5f 66 69  2_perf_sample_fi
.  0030:  6c 74 65 72 00 00 00 00 00 00 00 00 00 00 00 00  lter............
.  0040:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[...]
.  0110:  74 65 73 74 5f 76 61 6c 75 65 00 00 00 00 00 00  test_value......
.  0120:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[...]
.  0150:  34 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00  42..............
.  0160:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[...]

0 0x50fc8 [0x260]: PERF_RECORD_BPF_METADATA \
      prog bpf_prog_1e0a2e366e56f1a2_perf_sample_filter
  entry 0:           test_value = 42
: unhandled!

Signed-off-by: Blake Jones 
Link: https://lore.kernel.org/r/20250612194939.162730-5-blakejones@google.com
Signed-off-by: Namhyung Kim

perf script: Print PERF_AUX_FLAG_COLLISION flag

2025-05-28T18:08:25+00:00

Print out the collision flag for AUX trace data. This is helpful for
inspecting sample collisions.

After:

  0x217b60@/data_nvme1n1/niayan01/upstream/perf.data [0x40]: event: 11
  .
  . ... raw event: size 64 bytes
  .  0000:  0b 00 00 00 00 00 40 00 d2 ef 3f 00 00 00 00 00  ......@...?.....
  .  0010:  ff 0f 00 00 00 00 00 00 08 00 00 00 00 00 00 00  ................
  .  0020:  1c 01 00 00 1c 01 00 00 10 bf 38 d6 11 01 00 00  ..........8.....
  .  0030:  03 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00  ................

  3 1176120114960 0x217b60 [0x40]: PERF_RECORD_AUX offset: 0x3fefd2 size: 0xfff flags: 0x8 [C]

The added character '[C]' indicates the collision.

Signed-off-by: Leo Yan 
Cc: Adrian Hunter 
Cc: Ian Rogers 
Cc: Jiri Olsa 
Cc: Kan Liang 
Cc: Namhyung Kim 
Link: https://lore.kernel.org/r/20250528153519.188644-1-leo.yan@arm.com
Signed-off-by: Arnaldo Carvalho de Melo