kernel/linux.git/tools/perf/util/machine.c, branch v7.2-rc1

perf machine: Use snprintf() for guestmount path construction

2026-06-17T12:21:03+00:00

machines__findnew() and machines__create_guest_kernel_maps() use sprintf() to build paths by prepending symbol_conf.guestmount. Both write into PATH_MAX stack buffers, but guestmount comes from user configuration and is not length-checked. A guestmount path at or near PATH_MAX causes a stack buffer overflow. Switch to snprintf() with sizeof() to prevent overflow. The subsequent access()/fopen() calls will fail on a truncated path. Fixes: a1645ce12adb6c9c ("perf: 'perf kvm' tool for monitoring guest performance from host") Reported-by: sashiko-bot Cc: Zhang, Yanmin Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo

perf machine: Propagate machine__init() error to callers

2026-06-17T12:21:03+00:00

machine__init() always returns 0 even when memory allocation fails, because commit 81f981d7ec43ed93 ("perf machine: Free root_dir in machine__init() error path") introduced 'int err = -ENOMEM' and an error cleanup path but left the final 'return 0' instead of 'return err'. Fix by returning err, check the return value in __machine__new_host() which was ignoring it, and change machines__init() from void to int so it too can propagate the error to perf_session__new(), aslr_tool__init() and test callers. The error cleanup also used zfree(&machine->kmaps), but kmaps is a refcounted maps structure — use maps__zput() to properly drop the reference, matching machine__exit(). Move dsos__init() and threads__init() before the first fallible allocation (maps__new) so that machine__exit() is safe to call on any machine struct that machine__init() touched, even on early failure. Fixes: 81f981d7ec43ed93 ("perf machine: Free root_dir in machine__init() error path") Reported-by: sashiko-bot Cc: Ian Rogers Cc: Jiri Olsa Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo

perf tools: Use snprintf() for root_dir path construction

2026-06-17T11:28:44+00:00

get_kernel_version() in machine.c and dso__load_guest_kernel_sym() in symbol.c use sprintf() to construct paths by prepending root_dir to "/proc/version" and "/proc/kallsyms" respectively. Both write into PATH_MAX stack buffers, but root_dir comes from --guestmount or KVM configuration and is not length-checked. A root_dir at or near PATH_MAX causes a stack buffer overflow. Switch to snprintf() with sizeof(path) to prevent overflow. Reported-by: sashiko-bot Fixes: a1645ce12adb6c9c ("perf: 'perf kvm' tool for monitoring guest performance from host") Cc: Zhang Yanmin Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo

perf maps: Add maps__mutate_mapping

2026-06-15T12:01:27+00:00

During kernel ELF symbol parsing (dso__process_kernel_symbol), proc kallsyms image loading (dso__load_kernel_sym, dso__load_guest_kernel_sym), and dynamic kernel memory map alignment updates (machine__update_kernel_mmap), the loader directly modifies live virtual address boundary keys fields on map objects. If these boundaries are mutated while the map pointer actively resides inside the parent maps cache array list (kmaps) outside of any lock closure, an unsafe concurrent window is exposed where parallel worker lookup threads (e.g., inside perf top) can mistakenly assume the cache remains sorted based on stale parameters, executing binary search queries (bsearch) across an unsorted range and triggering lookup failures. Fix this by introducing maps__mutate_mapping() that explicitly acquires the parent maps write semaphore lock, executes an incoming mutation callback block to perform the field updates under lock protection, and invalidates the sorted tracking flags prior to releasing the write lock. This guarantees synchronization invariants, closing the concurrent lookup race window. The adjacent module alignment pass inside machine__create_kernel_maps() is safely preserved as a high-performance lockless pass, as its invocation lifecycle bounds remain strictly single-threaded by contract during session initialization construction. To safely support this unconditional down_write write lock mutator without recursive read-to-write self-deadlock upgrades during lazy symbol loading, we introduce a public maps__load_maps() API. It copies map pointers under a brief read lock and force-loads all modules locklessly outside the lock. Callers (such as perf inject) must pre-load all kernel symbol maps up front at startup using maps__load_maps(), completely bypassing dynamic runtime mutations. Fixes: 39b12f781271 ("perf tools: Make it possible to read object code from vmlinux") Assisted-by: Antigravity:gemini-3.1-pro Signed-off-by: Ian Rogers Tested-by: James Clark Cc: Adrian Hunter Cc: Gabriel Marin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo

perf symbol: Add setters for bitfields sharing a byte to avoid concurrent update issues

2026-06-03T19:53:45+00:00

A problem with putting bitfields into struct symbol is that other bits in the symbol could be updated concurrently and only one update to the underlying storage unit happen, leading to lost updates. To avoid this, use atomics to atomically read or set part of 16-bits of flags in the symbol. Add accessors to simplify this. The idle value has 3 values in preparation for a later change that will lazily update it. Assisted-by: Gemini:gemini-3.1-pro-preview Signed-off-by: Ian Rogers Acked-by: Namhyung Kim Cc: Alexander Gordeev Cc: Heiko Carstens Cc: Honglei Wang Cc: Jan Polensky Cc: Sumanth Korikkar Cc: Thomas Richter Cc: Vasily Gorbik Signed-off-by: Arnaldo Carvalho de Melo

perf machine: Use perf_env e_machine rather than arch

2026-06-03T19:46:37+00:00

The arch string is derived from uname and may be normalized causing potential differences meaning the ELF machine can be more precise. Reduce the scope of machine__is as often it is better to use a thread for the e_machine rather than the machine. Switch from string to ELF machine constant comparisons. Signed-off-by: Ian Rogers Acked-by: Namhyung Kim Cc: Alexander Gordeev Cc: Heiko Carstens Cc: Honglei Wang Cc: Jan Polensky Cc: Sumanth Korikkar Cc: Thomas Richter Cc: Vasily Gorbik Signed-off-by: Arnaldo Carvalho de Melo

perf: Extract is_ignored_kernel_symbol() for kernel mapping symbol filtering

2026-05-27T11:14:37+00:00

Mapping symbol filtering is scattered across multiple files with inconsistent checks. The kernel's own is_mapping_symbol() covers x86 local symbols ('.L*' and 'L0*') on top of the '$' prefix used by ARM/AArch64/RISC-V, but the perf tool only checks '$'. Extract is_ignored_kernel_symbol() into symbol.h matching the kernel definition, and convert the kallsyms and ksymbol event paths to use it. Add ksymbol event name validation and early mapping symbol filtering before any state mutation. Signed-off-by: Rui Qi Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Mark Rutland Cc: Peter Zijlstra Signed-off-by: Arnaldo Carvalho de Melo

perf callchain: Don't pass evsel and sample

2026-05-20T19:35:59+00:00

As struct perf_sample now directly contains its own resolved evsel pointer, passing the evsel separately is redundant and clutters the interface. Remove the redundant evsel parameter from callchain-specific handlers and structures, ensuring the tool always directly accesses the evsel bound to the sample. This simplifies the API signatures and eliminates the risk of passing an inconsistent evsel. Signed-off-by: Ian Rogers Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Albert Ou Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Andi Kleen Cc: Andrew Jones Cc: Anup Patel Cc: Athira Rajeev Cc: Blake Jones Cc: Chen Ni Cc: Chun-Tse Shao Cc: Dapeng Mi Cc: Derek Foreman Cc: Dmitriy Vyukov Cc: Dr. David Alan Gilbert Cc: Howard Chu Cc: Hrishikesh Suresh Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Quan Zhou Cc: Ravi Bangoria Cc: Swapnil Sapkal Cc: Thomas Falcon Cc: Tianyou Li Cc: Yujie Liu Cc: tanze Signed-off-by: Arnaldo Carvalho de Melo

perf callchain lbr: Make the leaf IP that of the sample

2026-02-06T21:10:44+00:00

The current IP of a leaf function when reported from a perf record with "--call-graph lbr" is the "to" field of the LBR branch stack record. The sample for the event being recorded may be further into the function and there may be inlining information associated with it. Rather than use the branch stack "to" field in this case switch to the callchain appending the sample->ip and thereby allowing the inline information to show. Before this change: ``` $ perf record --call-graph lbr perf test -w inlineloop ... $ perf script --fields +srcline ... perf-inlineloop 467586 4649.344493: 950905 cpu_core/cycles/P: 55dfda2829c0 parent+0x0 (perf) inlineloop.c:31 55dfda282a96 inlineloop+0x86 (perf) inlineloop.c:47 55dfda236420 run_workload+0x59 (perf) builtin-test.c:715 55dfda236b03 cmd_test+0x413 (perf) builtin-test.c:825 ... ``` After this change: ``` $ perf record --call-graph lbr perf test -w inlineloop ... $ perf script --fields +srcline ... perf-inlineloop 529703 11878.680815: 950905 cpu_core/cycles/P: 555ce86be9e6 leaf+0x26 inlineloop.c:20 (inlined) 555ce86be9e6 middle+0x26 inlineloop.c:27 (inlined) 555ce86be9e6 parent+0x26 (perf) inlineloop.c:32 555ce86bea96 inlineloop+0x86 (perf) inlineloop.c:47 555ce8672420 run_workload+0x59 (perf) builtin-test.c:715 555ce8672b03 cmd_test+0x413 (perf) builtin-test.c:825 ... ``` Reviewed-by: Andi Kleen Signed-off-by: Ian Rogers Acked-by: Dapeng Mi Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Dmitriy Vyukov Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Krzysztof Łopatowski Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Weilin Wang Signed-off-by: Arnaldo Carvalho de Melo

perf map_symbol: Switch from holding maps to holding thread

2026-01-23T19:58:39+00:00

maps may belong to >1 thread. In contexts like symbolization information from the thread may be useful, such as the ELF machine. As the maps can be gained from the thread switch from holding maps in struct map_symbol to holding the thread. Holding the maps in addr_location is also redundant, switch this to using thread__maps. Reviewed-by: James Clark Signed-off-by: Ian Rogers Cc: Aditya Bodkhe Cc: Adrian Hunter Cc: Albert Ou Cc: Alexander Shishkin Cc: Alexandre Ghiti Cc: Athira Rajeev Cc: Bill Wendling Cc: Dr. David Alan Gilbert Cc: Guo Ren Cc: Howard Chu Cc: Ingo Molnar Cc: Jiri Olsa Cc: John Garry Cc: Julia Lawall Cc: Justin Stitt Cc: Krzysztof Łopatowski Cc: Leo Yan Cc: Namhyung Kim Cc: Nathan Chancellor Cc: Nick Desaulniers Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Peter Zijlstra Cc: Sergei Trofimovich Cc: Shimin Guo Cc: Suchit Karunakaran Cc: Thomas Falcon Cc: Tianyou Li Cc: Will Deacon Cc: Zecheng Li Signed-off-by: Arnaldo Carvalho de Melo