linux.git/tools/lib/api/fd/array.c, branch v7.3-rc2

tools/lib/api: Fix potential double-free from fdarray__grow()

2026-07-16T16:56:47+00:00

If the realloc for fda->entries succeeds but the realloc for fda->priv
fails, the error path frees the newly allocated entries.

However, fda->entries is neither updated to point to the new entries block
nor cleared to NULL. If realloc moved the allocation to a new block, the
old fda->entries pointer is now freed memory.

When fdarray__exit() is later called to clean up, it executes
free(fda->entries), which would trigger a double-free on that old pointer.

Reported-by: Sashiko Review 
Closes: https://lore.kernel.org/linux-perf-users/20260710200150.11FE71F00A3A@smtp.kernel.org
Reviewed-by: Ian Rogers 
Signed-off-by: Namhyung Kim

perf record: Fix teardown hang on system-wide multi-threaded sessions

2026-07-10T22:30:05+00:00

Under system-wide (-a) parallel streaming mode (--threads=cpu),
background recording threads can be inundated by a continuous
firehose of hardware samples generated by the OS. In this state,
a background thread's local hit count remains unequal to its
sample count, causing it to bypass the blocking fdarray__poll()
call entirely on each iteration of its recording loop.

Because the termination check relies on the POLLHUP event status
populated specifically by fdarray__poll(), bypassing it prevents
the background thread from ever recognizing that its control pipe
was closed by the main thread. This traps the background thread
in an infinite recording loop, hanging the main thread indefinitely
as it awaits a termination acknowledgment that never arrives.

Ensure teardown completion by adding explicit evlist__disable()
calls in the main thread's cleanup paths at out_child: and
out_child_no_flush:. Additionally, patch fdarray__filter() to
respect the fdarray_flag__nonfilterable flag, preventing it
from incorrectly setting the background thread's control pipe
file descriptor to -1 and clearing its revents mask upon
processing termination POLLHUP signals.

Fixes: f94563fac269 ("perf record: fix poll storm when monitored threads exit")
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Ian Rogers 
Signed-off-by: Namhyung Kim

perf record: fix poll storm when monitored threads exit

2026-07-08T05:59:07+00:00

When `perf record` samples a multi-threaded process and one of the
target threads exits during the session, perf itself may start burning
100% CPU (up to 200% across two cores) until the session ends.  A
single dead fd is sufficient to trigger this; it can be reproduced with
15 pthreads in a compute loop where one thread exits halfway through.

The root cause is two independent instances of the same defect: dead
perf_event ring-buffer fds are left in a pollfd array.  When a monitored
thread exits, the kernel closes its ring-buffer fd, which then returns
POLLHUP.  POSIX specifies that poll() always reports POLLHUP and POLLERR
regardless of the events mask, so any dead fd left in the array makes
poll() return immediately every time, spinning in a tight loop:

  3 seconds: 256,600 poll() calls, 0 context switches, only 21 write()
  Woken up count goes from ~0 to 1,300,000+

There are two affected poll paths, fixed together here:

1. Record main loop, via fdarray__filter() (tools/lib/api/fd/array.c).
   Since commit 59b4412f27f1 ("libperf: Avoid internal moving of
   fdarray fds") it only zeroes events/revents without setting fd to
   -1, so poll() keeps reporting POLLHUP for the entry.  Setting
   fd = -1 makes poll() skip it, matching the pattern already used in
   the control-fd path at tools/perf/builtin-record.c:1673.

2. BPF sideband thread, perf_evlist__poll_thread()
   (tools/perf/util/sideband_evlist.c).  This thread polls for
   PERF_RECORD_BPF_EVENT but, unlike the main record loop, never calls
   fdarray__filter() at all, so dead fds accumulate forever and it
   spins at 100% CPU:

     Before fix: dJiffies=101, wchan=0 (running)
     After fix:  dJiffies=0,   wchan=do_sys_poll (blocking)

   Fixed by calling the existing evlist__filter_pollfd() helper after
   evlist__poll(), mirroring the main record loop.   is
   included for the POLLERR/POLLHUP macros (previously unused there).

The two fixes compose: fix 1 makes poll() ignore dead fds (fd=-1); fix
2 ensures the sideband thread actually performs the filtering.  Both
paths are affected in all kernels from v5.1/v5.9 to the current master
(7.2-rc1); the source of both functions is byte-identical across them.

BPF event recording is preserved: after the fix, perf.data still
contains PERF_RECORD_BPF_EVENT records and bpf_prog_info entries.

Verified on perf 6.1.76, 6.6.143 and 7.2-rc1 with a minimal reproducer
(Woken up 1,300,000 -> 3, CPU 100% -> 0%) and an A/B orthogonal test:
keeping the unpatched binary but preventing the target thread from
exiting also makes the storm disappear, confirming the trigger.

Fixes: 59b4412f27f1 ("libperf: Avoid internal moving of fdarray fds")
Fixes: 657ee5531903 ("perf evlist: Introduce side band thread")
Signed-off-by: Jiawei Sun 
Reviewed-by: Ian Rogers 
Signed-off-by: Namhyung Kim

tools lib: Introduce fdarray duplicate function

2022-02-10T19:25:20+00:00

Introduce a function to duplicate an existing file descriptor in
the fdarray structure. The function returns the position of the duplicated
file descriptor.

Reviewed-by: Riccardo Mancini 
Signed-off-by: Alexey Bayduraev 
Tested-by: Jiri Olsa 
Tested-by: Riccardo Mancini 
Acked-by: Namhyung Kim 
Cc: Adrian Hunter 
Cc: Alexander Antonov 
Cc: Alexander Shishkin 
Cc: Alexei Budankov 
Cc: Andi Kleen 
Cc: Ingo Molnar 
Cc: Namhyung Kim 
Cc: Peter Zijlstra 
Link: https://lore.kernel.org/r/2891f1def287d5863cc82683a4d5879195c8d90c.1642440724.git.alexey.v.bayduraev@linux.intel.com
Signed-off-by: Arnaldo Carvalho de Melo

libperf: Avoid counting of nonfilterable fdarray fds

2020-07-21T12:53:22+00:00

Avoid counting of struct pollfd *entries objects with
fdarray_flag__nonfilterable flag by fdarray__filter().

Nonfilterable objects are still processed if requested revents have been
signaled for them.

Signed-off-by: Alexey Budankov 
Acked-by: Jiri Olsa 
Acked-by: Namhyung Kim 
Cc: Alexander Shishkin 
Cc: Andi Kleen 
Cc: Peter Zijlstra 
Link: http://lore.kernel.org/lkml/b5ab0d2c-b742-0032-e8d3-c8e2eb423c42@linux.intel.com
Signed-off-by: Arnaldo Carvalho de Melo

libperf: Add flags to fdarray fds objects

2020-07-21T12:52:51+00:00

Store flags per struct pollfd *entries object in a bitmap of int size.

Implement fdarray_flag__nonfilterable flag to skip object from counting
by fdarray__filter().

Fixed fdarray test issue reported by kernel test robot.

Reported-by: kernel test robot 
Signed-off-by: Alexey Budankov 
Acked-by: Jiri Olsa 
Acked-by: Namhyung Kim 
Cc: Alexander Shishkin 
Cc: Andi Kleen 
Cc: Peter Zijlstra 
Link: http://lore.kernel.org/lkml/6b7d43ff-0801-d5dd-4e90-fcd86b17c1c8@linux.intel.com
Signed-off-by: Arnaldo Carvalho de Melo

libperf: Avoid internal moving of fdarray fds

2020-07-21T11:49:30+00:00

Avoid moving of fds by fdarray__filter() so fds indices returned by
fdarray__add() can be used for access and processing of objects at
struct pollfd *entries.

Signed-off-by: Alexey Budankov 
Acked-by: Jiri Olsa 
Acked-by: Namhyung Kim 
Cc: Alexander Shishkin 
Cc: Andi Kleen 
Cc: Peter Zijlstra 
Link: http://lore.kernel.org/lkml/676844f8-55d3-c628-23db-aa163a81519e@linux.intel.com
Signed-off-by: Arnaldo Carvalho de Melo

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 251

2019-06-05T15:30:26+00:00

Based on 1 normalized pattern(s):

  released under the gpl v2 and only v2 not any later version

extracted by the scancode license scanner the SPDX license identifier

  GPL-2.0-only

has been chosen to replace the boilerplate/reference in 12 file(s).

Signed-off-by: Thomas Gleixner 
Reviewed-by: Steve Winslow 
Reviewed-by: Alexios Zavras 
Reviewed-by: Kate Stewart 
Reviewed-by: Allison Randal 
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190529141332.526460839@linutronix.de
Signed-off-by: Greg Kroah-Hartman

tools: Pass arg to fdarray__filter's call back function

2016-05-30T15:41:46+00:00

Before this patch there's no way to pass arguments to fdarray__filter's
call back function.

This improvement will be used by 'perf record' to support unmapping ring
buffer for both main evlist and overwrite evlist. Without this patch
there's no way to track overwrite evlist from 'struct fdarray'.

Signed-off-by: Wang Nan 
Cc: He Kuang 
Cc: Jiri Olsa 
Cc: Masami Hiramatsu 
Cc: Namhyung Kim 
Cc: Zefan Li 
Cc: pi3orama@163.com
Link: http://lkml.kernel.org/r/1464183898-174512-10-git-send-email-wangnan0@huawei.com
Signed-off-by: Arnaldo Carvalho de Melo

tools lib fd array: Allow associating an integer cookie with each entry

2014-09-25T19:46:55+00:00

We will use this in perf's evlist class so that it can, at
fdarray__filter() time, to unmap the associated ring buffer.

We may need to have further info associated with each fdarray entry, in
that case we'll make that int array a 'union fdarray_priv' one and put a
pointer there so that users can stash whatever they want there. For now,
an int is enough tho.

v2: Add clarification to the per array entry priv area, as well as make
    it a union, which makes usage a bit longer, but if/when we make it
    use more space by allowing per entry pointers existing users source
    code will not have to be changed, just rebuilt.

Cc: Adrian Hunter 
Cc: Borislav Petkov 
Cc: Corey Ashford 
Cc: David Ahern 
Cc: Frederic Weisbecker 
Cc: Ingo Molnar 
Cc: Jean Pihet 
Cc: Jiri Olsa 
Cc: Namhyung Kim 
Cc: Paul Mackerras 
Cc: Peter Zijlstra 
Signed-off-by: Arnaldo Carvalho de Melo 

Link: http://lkml.kernel.org/n/tip-0p00bn83quck3fio3kcs9vca@git.kernel.org