linux-stable.git/tools/perf/util/thread.c, branch linux-rolling-lts

perf tools: Fix thread__set_comm_from_proc() on empty comm file

2026-07-24T14:16:24+00:00

[ Upstream commit 31d596054550f793508abe7dd593853ece47d428 ]

thread__set_comm_from_proc() calls procfs__read_str() then strips
the trailing newline via comm[sz - 1] = '\0'.  procfs__read_str()
allocates the buffer before reading, so on an empty /proc/pid/comm
(reachable during late exit teardown) it returns success with sz = 0
and an unterminated heap buffer.

The sz - 1 underflow was the original sashiko finding: it writes a
null byte before the allocation.  But even with a sz > 0 guard on
the newline strip, the unterminated buffer would still be passed to
thread__set_comm() which calls strlen() — an unbounded heap read.

Fix by treating sz == 0 as failure: free the buffer and return -1.
This is consistent with pmu.c's perf_pmu__parse_scale/unit which
already treat len == 0 from filename__read_str as an error.

Fixes: 2f3027ac28bf6bc3 ("perf thread: Introduce method to set comm from /proc/pid/self")
Reported-by: sashiko-bot 
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo 
Signed-off-by: Sasha Levin

perf thread: Ensure comm_lock held for comm_list

2025-06-11T20:40:31+00:00

Add thread safety annotations for comm_list and add locking for two
instances where the list is accessed without the lock held (in
contradiction to ____thread__set_comm()).

Signed-off-by: Ian Rogers 
Link: https://lore.kernel.org/r/20250529192206.971199-1-irogers@google.com
Signed-off-by: Namhyung Kim

perf callchain: Always populate the addr_location map when adding IP

2025-05-31T11:58:30+00:00

Dropping symbols also meant the callchain maps wasn't populated, but
the callchain map is needed to find the DSO.

Plumb the symbols option better, falling back to thread__find_map()
rather than thread__find_symbol() when symbols are disabled.

Fixes: 02b2705017d2e5ad ("perf callchain: Allow symbols to be optional when resolving a callchain")
Signed-off-by: Ian Rogers 
Cc: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Andi Kleen 
Cc: Athira Rajeev 
Cc: Ben Gainey 
Cc: Chaitanya S Prakash 
Cc: Charlie Jenkins 
Cc: Chun-Tse Shao 
Cc: Colin Ian King 
Cc: Dmitriy Vyukov 
Cc: Dr. David Alan Gilbert 
Cc: Graham Woodward 
Cc: Howard Chu 
Cc: Ilkka Koskinen 
Cc: Ingo Molnar 
Cc: James Clark 
Cc: Jiri Olsa 
Cc: John Garry 
Cc: Kajol Jain 
Cc: Kan Liang 
Cc: Krzysztof Łopatowski 
Cc: Leo Yan 
Cc: Levi Yun 
Cc: Li Huafei 
Cc: linux-arm-kernel@lists.infradead.org
Cc: Mark Rutland 
Cc: Martin Liška 
Cc: Masami Hiramatsu 
Cc: Matt Fleming 
Cc: Mike Leach 
Cc: Namhyung Kim 
Cc: Peter Zijlstra 
Cc: Ravi Bangoria 
Cc: Song Liu 
Cc: Steinar H. Gunderson 
Cc: Stephen Brennan 
Cc: Steve Clevenger 
Cc: Thomas Falcon 
Cc: Veronika Molnarova 
Cc: Weilin Wang 
Cc: Will Deacon 
Cc: Yicong Yang 
Cc: Yujie Liu 
Cc: Zhongqiu Han 
Cc: Zixian Cai 
Link: https://lore.kernel.org/r/20250529044000.759937-2-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo

Revert "perf thread: Ensure comm_lock held for comm_list"

2025-05-28T15:59:17+00:00

This reverts commit 8f454c95817d15ee529d58389612ea4b34f5ffb3.

'perf top' is freezing on exit sometimes, bisected to this one, revert.

Cc: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Athira Rajeev 
Cc: Bill Wendling 
Cc: Chaitanya S Prakash 
Cc: Fei Lang 
Cc: Howard Chu 
Cc: Ian Rogers 
Cc: Ingo Molnar 
Cc: James Clark 
Cc: Jiri Olsa 
Cc: Justin Stitt 
Cc: Kan Liang 
Cc: Mark Rutland 
Cc: Namhyung Kim 
Cc: Nathan Chancellor 
Cc: Nick Desaulniers 
Cc: Peter Zijlstra 
Cc: Stephen Brennan 
Link: https://lore.kernel.org/r/aDcyvvOKZkRYbjul@x1
Signed-off-by: Arnaldo Carvalho de Melo

perf thread: Ensure comm_lock held for comm_list

2025-05-21T18:07:13+00:00

Add thread safety annotations for comm_list and add locking for two
instances where the list is accessed without the lock held (in
contradiction to ____thread__set_comm()).

Signed-off-by: Ian Rogers 
Cc: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Athira Rajeev 
Cc: Bill Wendling 
Cc: Chaitanya S Prakash 
Cc: Fei Lang 
Cc: Howard Chu 
Cc: Ingo Molnar 
Cc: James Clark 
Cc: Jiri Olsa 
Cc: Justin Stitt 
Cc: Kan Liang 
Cc: Mark Rutland 
Cc: Namhyung Kim 
Cc: Nathan Chancellor 
Cc: Nick Desaulniers 
Cc: Peter Zijlstra 
Cc: Stephen Brennan 
Link: https://lore.kernel.org/r/20250519224645.1810891-3-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo

perf trace: Add missing threadput() in threade_machine()

2025-05-08T14:50:44+00:00

Add missing thread__put() of the found parent thread in
thread__e_machine().

Reviewed-by: Howard Chu 
Signed-off-by: Ian Rogers 
Cc: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Ingo Molnar 
Cc: Jiri Olsa 
Cc: Kan Liang 
Cc: Mark Rutland 
Cc: Namhyung Kim 
Cc: Peter Zijlstra 
Link: https://lore.kernel.org/r/20250401202715.3493567-1-irogers@google.com
[ split from a larger patch ]
Signed-off-by: Arnaldo Carvalho de Melo

perf thread: Add support for reading the e_machine type for a thread

2025-03-21T05:58:05+00:00

First try to read the e_machine from the dsos associated with the
thread's maps. If live use the executable from /proc/pid/exe and read
the e_machine from the ELF header. On failure use EM_HOST. Change
builtin-trace syscall functions to pass e_machine from the thread
rather than EM_HOST, so that in later patches when syscalltbl can use
the e_machine the system calls are specific to the architecture.

Signed-off-by: Ian Rogers 
Reviewed-by: Namhyung Kim 
Acked-by: Arnaldo Carvalho de Melo 
Link: https://lore.kernel.org/r/20250319050741.269828-8-irogers@google.com
Signed-off-by: Namhyung Kim

perf callchain: Fix stitch LBR memory leaks

2024-08-08T20:30:27+00:00

The 'struct callchain_cursor_node' has a 'struct map_symbol' whose maps
and map members are reference counted. Ensure these values use a _get
routine to increment the reference counts and use map_symbol__exit() to
release the reference counts.

Do similar for 'struct thread's prev_lbr_cursor, but save the size of
the prev_lbr_cursor array so that it may be iterated.

Ensure that when stitch_nodes are placed on the free list the
map_symbols are exited.

Fix resolve_lbr_callchain_sample() by replacing list_replace_init() to
list_splice_init(), so the whole list is moved and nodes aren't leaked.

A reproduction of the memory leaks is possible with a leak sanitizer
build in the perf report command of:

  ```
  $ perf record -e cycles --call-graph lbr perf test -w thloop
  $ perf report --stitch-lbr
  ```

Reviewed-by: Kan Liang 
Fixes: ff165628d72644e3 ("perf callchain: Stitch LBR call stack")
Signed-off-by: Ian Rogers 
[ Basic tests after applying the patch, repeating the example above ]
Tested-by: Arnaldo Carvalho de Melo 
Cc: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Andi Kleen 
Cc: Anne Macedo 
Cc: Changbin Du 
Cc: Ingo Molnar 
Cc: Jiri Olsa 
Cc: Mark Rutland 
Cc: Namhyung Kim 
Cc: Peter Zijlstra 
Link: https://lore.kernel.org/r/20240808054644.1286065-1-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo

perf thread: Fixes to thread__new() related to initializing comm

2024-05-09T21:15:25+00:00

Freeing the thread on failure won't work with reference count checking,
use thread__delete().

Don't allocate the comm_str, use a stack allocation instead.

Fixes: f6005cafebab72f8 ("perf thread: Add reference count checking")
Signed-off-by: Ian Rogers 
Cc: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Ingo Molnar 
Cc: James Clark 
Cc: Jiri Olsa 
Cc: Kan Liang 
Cc: Leo Yan 
Cc: Mark Rutland 
Cc: Namhyung Kim 
Cc: Peter Zijlstra 
Link: https://lore.kernel.org/r/20240508035301.1554434-5-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo

perf dso: Add reference count checking and accessor functions

2024-05-06T18:28:49+00:00

Add reference count checking to struct dso, this can help with
implementing correct reference counting discipline. To avoid
RC_CHK_ACCESS everywhere, add accessor functions for the variables in
struct dso.

The majority of the change is mechanical in nature and not easy to
split up.

Committer testing:

'perf test' up to this patch shows no regressions.

But:

  util/symbol.c: In function ‘dso__load_bfd_symbols’:
  util/symbol.c:1683:9: error: too few arguments to function ‘dso__set_adjust_symbols’
   1683 |         dso__set_adjust_symbols(dso);
        |         ^~~~~~~~~~~~~~~~~~~~~~~
  In file included from util/symbol.c:21:
  util/dso.h:268:20: note: declared here
    268 | static inline void dso__set_adjust_symbols(struct dso *dso, bool val)
        |                    ^~~~~~~~~~~~~~~~~~~~~~~
  make[6]: *** [/home/acme/git/perf-tools-next/tools/build/Makefile.build:106: /tmp/tmp.ZWHbQftdN6/util/symbol.o] Error 1
    MKDIR   /tmp/tmp.ZWHbQftdN6/tests/workloads/
  make[6]: *** Waiting for unfinished jobs....

This was updated:

  -       symbols__fixup_end(&dso->symbols, false);
  -       symbols__fixup_duplicate(&dso->symbols);
  -       dso->adjust_symbols = 1;
  +       symbols__fixup_end(dso__symbols(dso), false);
  +       symbols__fixup_duplicate(dso__symbols(dso));
  +       dso__set_adjust_symbols(dso);

But not build tested with BUILD_NONDISTRO and libbfd devel files installed
(binutils-devel on fedora).

Add the missing argument:

   	symbols__fixup_end(dso__symbols(dso), false);
   	symbols__fixup_duplicate(dso__symbols(dso));
  -	dso__set_adjust_symbols(dso);
  +	dso__set_adjust_symbols(dso, true);

Signed-off-by: Ian Rogers 
Tested-by: Arnaldo Carvalho de Melo 
Cc: Adrian Hunter 
Cc: Ahelenia Ziemiańska 
Cc: Alexander Shishkin 
Cc: Andi Kleen 
Cc: Athira Rajeev 
Cc: Ben Gainey 
Cc: Changbin Du 
Cc: Chengen Du 
Cc: Colin Ian King 
Cc: Dima Kogan 
Cc: Ilkka Koskinen 
Cc: Ingo Molnar 
Cc: James Clark 
Cc: Jiri Olsa 
Cc: K Prateek Nayak 
Cc: Kan Liang 
Cc: Leo Yan 
Cc: Li Dong 
Cc: Mark Rutland 
Cc: Masami Hiramatsu 
Cc: Namhyung Kim 
Cc: Paran Lee 
Cc: Peter Zijlstra 
Cc: Song Liu 
Cc: Sun Haiyong 
Cc: Thomas Richter 
Cc: Tiezhu Yang 
Cc: Yanteng Si 
Cc: zhaimingbing 
Link: https://lore.kernel.org/r/20240504213803.218974-6-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo

linux-stable.git/tools/perf/util/thread.c, branch linux-rolling-lts

perf tools: Fix thread__set_comm_from_proc() on empty comm file

perf thread: Ensure comm_lock held for comm_list

perf callchain: Always populate the addr_location map when adding IP

Revert "perf thread: Ensure comm_lock held for comm_list"

perf thread: Ensure comm_lock held for comm_list

perf trace: Add missing thread__put() in thread__e_machine()

perf thread: Add support for reading the e_machine type for a thread

perf callchain: Fix stitch LBR memory leaks

perf thread: Fixes to thread__new() related to initializing comm

perf dso: Add reference count checking and accessor functions

perf trace: Add missing threadput() in threade_machine()