linux-toradex.git/tools/perf/builtin-c2c.c, branch v7.2-rc5

perf c2c: Fix hist entry and format list leaks in c2c_he_free()

2026-06-17T12:21:03+00:00

c2c_he_free() calls hists__delete_entries() which only walks the
output-sorted entries tree.  During c2c resort, when cacheline entries
are merged and the redundant entry is freed, the inner hists have not
been output-resorted yet, so hists->entries is empty.  The actual inner
hist_entry objects live in entries_in_array[] and entries_collapsed,
which are never walked, leaking all inner hist_entry objects for every
merged cacheline.

Additionally, the dynamically allocated format entries on hists->list
are never unregistered or freed.

Fix both issues by switching to hists__delete_all_entries() which walks
all rb_root trees, and calling perf_hpp__reset_output_field() to clean
up format entries.

Fixes: bf0e0d407ea09ce5 ("perf c2c report: Add sample processing")
Reported-by: sashiko-bot 
Cc: Jiri Olsa 
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo

perf c2c: Free format list entries when c2c_hists__init() fails

2026-06-17T12:21:03+00:00

When c2c_hists__init() fails partway through hpp_list__parse(),
dynamically allocated format structures that were already added to
hists->list are leaked because he__get_c2c_hists() frees the hists
container without first unregistering the format entries.

Call perf_hpp__reset_output_field() before freeing the hists container
on the error path, matching what c2c_he_free() already does on the
normal destruction path.

Fixes: 17a7c5946d79a12c ("perf c2c report: Decode c2c_stats for hist entries")
Reported-by: sashiko-bot 
Cc: Jiri Olsa 
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo

perf c2c: Free format list entries when releasing c2c hist entries

2026-06-17T11:29:03+00:00

c2c_hists__init() calls hpp_list__parse() which allocates and registers
format entries on hists->list.  When c2c_he_free() destroys a c2c hist
entry, it deletes the histogram entries and frees the hists container but
never unregisters the format list entries, leaking them.

Call perf_hpp__reset_output_field() before freeing the hists to properly
unregister and free all format entries.

Fixes: f485e33c4543ac31 ("perf c2c report: Add cacheline hists processing")
Reported-by: sashiko-bot 
Cc: Jiri Olsa 
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo

perf c2c: Fix use-after-free in he__get_c2c_hists() error path

2026-06-06T16:44:46+00:00

he__get_c2c_hists() assigns c2c_he->hists before calling
c2c_hists__init().  If init fails, the error path calls free(hists)
but leaves c2c_he->hists pointing to freed memory.  On teardown,
c2c_he_free() finds the non-NULL pointer and calls
hists__delete_entries() on it, causing a use-after-free.

Set c2c_he->hists to NULL before freeing so teardown skips the
already-freed allocation.

Fixes: b2252ae67b687d2b ("perf c2c report: Decode c2c_stats for hist entries")
Reported-by: sashiko-bot 
Cc: Jiri Olsa 
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo

perf c2c: Bounds-check CPU IDs in setup_nodes() topology loop

2026-06-05T22:17:31+00:00

setup_nodes() iterates CPU maps from the perf.data topology header and
uses cpu.cpu directly as an array index into cpu2node[] (allocated with
c2c.cpus_cnt = env->nr_cpus_avail entries) and __set_bit(cpu.cpu, set)
(bitmap also sized to c2c.cpus_cnt).

A crafted perf.data with topology CPU IDs exceeding nr_cpus_avail causes
out-of-bounds heap writes into both the cpu2node array and the per-node
bitmap.

Add a bounds check to skip CPU IDs that fall outside the valid range.

Fixes: 1e181b92a2da ("perf c2c report: Add 'node' sort key")
Reported-by: sashiko-bot 
Cc: Jiri Olsa 
Cc: Namhyung Kim 
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo

perf c2c: Bounds-check CPU and node IDs before bitmap and array access

2026-06-05T22:17:31+00:00

c2c_he__set_cpu() passes sample->cpu directly to __set_bit(cpu, cpuset)
after only checking for the (u32)-1 sentinel.  The cpuset bitmap is
allocated with c2c.cpus_cnt bits (from env->nr_cpus_avail), so a crafted
perf.data with CPU IDs exceeding that count causes out-of-bounds heap
writes.

c2c_he__set_node() similarly passes the node ID from mem2node__node()
to __set_bit(node, nodeset) after only checking for negative values.
The nodeset bitmap is sized to c2c.nodes_cnt (from env->nr_numa_nodes),
so a node ID exceeding that causes OOB writes.

process_sample_event() indexes c2c.cpu2node[cpu] and
c2c_he->node_stats[node] without bounds checking.  Both arrays are
sized to c2c.cpus_cnt and c2c.nodes_cnt respectively.

Add bounds checks in all three paths:
  - c2c_he__set_cpu(): return if sample->cpu >= c2c.cpus_cnt
  - c2c_he__set_node(): return if node >= c2c.nodes_cnt
  - process_sample_event(): clamp cpu to 0 if >= cpus_cnt,
    guard node_stats access with bounds check

Fixes: 1e181b92a2da ("perf c2c report: Add 'node' sort key")
Reported-by: sashiko-bot 
Cc: Jiri Olsa 
Cc: Namhyung Kim 
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo

perf c2c: Use perf_env e_machine rather than arch

2026-06-03T19:50:15+00:00

Use the e_machine rather than arch string matching for AARCH64.

Add include of dwarf-regs.h in case the EM_AARCH64 isn't defined, sort
the headers given this include.

Signed-off-by: Ian Rogers 
Acked-by: Namhyung Kim 
Cc: Alexander Gordeev 
Cc: Heiko Carstens 
Cc: Honglei Wang 
Cc: Jan Polensky 
Cc: Sumanth Korikkar 
Cc: Thomas Richter 
Cc: Vasily Gorbik 
Signed-off-by: Arnaldo Carvalho de Melo

perf tools: Include file offset and event type name in skip messages

2026-06-03T19:31:03+00:00

Add the perf.data file offset and use perf_event__name() instead of raw
event type integers in the 'problem processing event, skipping it'
messages emitted by process_sample_event() callbacks across annotate,
c2c, diff, kmem, kvm, kwork, lock, report, script, and build-id.

This lets users cross-reference skipped events with 'perf report -D'
output.  Also add explicit #include "util/event.h" and 
where needed to avoid depending on transitive includes.

Reviewed-by: Ian Rogers 
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo

perf hist: Remove evsel parameter from inc samples functions

2026-05-20T19:35:59+00:00

As struct perf_sample now directly contains its own resolved evsel pointer,
passing the evsel separately is redundant and clutters the interface.

Remove the redundant evsel parameter from hist-specific handlers and
structures, ensuring the tool always directly accesses the evsel bound to the
sample. This simplifies the API signatures and eliminates the risk of passing
an inconsistent evsel.

Signed-off-by: Ian Rogers 
Acked-by: Namhyung Kim 
Cc: Adrian Hunter 
Cc: Albert Ou 
Cc: Alexander Shishkin 
Cc: Alexandre Ghiti 
Cc: Andi Kleen 
Cc: Andrew Jones 
Cc: Anup Patel 
Cc: Athira Rajeev 
Cc: Blake Jones 
Cc: Chen Ni 
Cc: Chun-Tse Shao 
Cc: Dapeng Mi 
Cc: Derek Foreman 
Cc: Dmitriy Vyukov 
Cc: Dr. David Alan Gilbert 
Cc: Howard Chu 
Cc: Hrishikesh Suresh 
Cc: Ingo Molnar 
Cc: James Clark 
Cc: Jiri Olsa 
Cc: Krzysztof Łopatowski 
Cc: Leo Yan 
Cc: Palmer Dabbelt 
Cc: Paul Walmsley 
Cc: Peter Zijlstra 
Cc: Quan Zhou 
Cc: Ravi Bangoria 
Cc: Swapnil Sapkal 
Cc: Thomas Falcon 
Cc: Tianyou Li 
Cc: Yujie Liu 
Cc: tanze 
Signed-off-by: Arnaldo Carvalho de Melo

perf callchain: Don't pass evsel and sample

2026-05-20T19:35:59+00:00

As struct perf_sample now directly contains its own resolved evsel pointer,
passing the evsel separately is redundant and clutters the interface.

Remove the redundant evsel parameter from callchain-specific handlers and
structures, ensuring the tool always directly accesses the evsel bound to the
sample. This simplifies the API signatures and eliminates the risk of passing
an inconsistent evsel.

Signed-off-by: Ian Rogers 
Acked-by: Namhyung Kim 
Cc: Adrian Hunter 
Cc: Albert Ou 
Cc: Alexander Shishkin 
Cc: Alexandre Ghiti 
Cc: Andi Kleen 
Cc: Andrew Jones 
Cc: Anup Patel 
Cc: Athira Rajeev 
Cc: Blake Jones 
Cc: Chen Ni 
Cc: Chun-Tse Shao 
Cc: Dapeng Mi 
Cc: Derek Foreman 
Cc: Dmitriy Vyukov 
Cc: Dr. David Alan Gilbert 
Cc: Howard Chu 
Cc: Hrishikesh Suresh 
Cc: Ingo Molnar 
Cc: James Clark 
Cc: Jiri Olsa 
Cc: Krzysztof Łopatowski 
Cc: Leo Yan 
Cc: Palmer Dabbelt 
Cc: Paul Walmsley 
Cc: Peter Zijlstra 
Cc: Quan Zhou 
Cc: Ravi Bangoria 
Cc: Swapnil Sapkal 
Cc: Thomas Falcon 
Cc: Tianyou Li 
Cc: Yujie Liu 
Cc: tanze 
Signed-off-by: Arnaldo Carvalho de Melo