From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6D5F42C1586; Mon, 19 Oct 2026 07:16:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.175.65.17 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792394206; cv=none; b=mOincHTefYsqlw6n8u8skaowbLvU286PcQ62TUfYpSYGro/H2TXKkGa1icuMCm6os7arM5wtZvwTrqqkB7keCREzMkDjzdxh8ove9Xk/P9B975RkTv0hlnVLDzqX/wpDOOSROv56tZ/n4UllNrflhyFiKUCuwJs0ros9v/zg7yc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792394206; c=relaxed/simple; bh=hLC8ZGkwaTfu6ZnXT5i21CGE3UrgbMZUHhQ0ocJXqYo=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=rs+2Fz346X+JO1NVNnJhBVV8zBNtfzPuU02H+OrqIBgKw0yjzuvpY/ip2P/Vr5N6DtdW+dvWke0BvZS0axh8qLBWGqPUOcx25PHNumZkAO5xvkagrVJEqkHgrwWJOKDR/IcTdmWQKbaPqxQ5u0G9UPus6okk8hvf8awMHuiNthY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=aJOYAohc; arc=none smtp.client-ip=198.175.65.17 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="aJOYAohc" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1792394206; x=1823930206; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=hLC8ZGkwaTfu6ZnXT5i21CGE3UrgbMZUHhQ0ocJXqYo=; b=aJOYAohcSta19KcW/Se8bZIPoyF4CHFVbVt8kCVqGGs+3ftc6ZzU7QYF 5Vfal+IhWsamc9ipbn3yDWPzG9yzalUe66nfhWURHcBgQryn2Q3AY2hJ9 JkhfyeFmhhoOzzBvbhn1rqadMRmWoZNXNzO6FXRjogBV+h/j1G/RhZQgb 7ebbjrXg9jo580ycyFcb9CrBkL7KWt3GfeQnTThSfpEYcvcUGKhwOAPT5 P7WOQRoCdgrPNyw4I+JQsZxhwLU4ss5Ck1/ngM3fmEsDMB+21nJqq13KK ytWinjVa4R8e2ZampS9WfTXVxYK41M4hLaNwkxK4s/sg4wu18leWAxumm Q==; X-CSE-ConnectionGUID: ux3iYjNuS26XqPoEaVf25A== X-CSE-MsgGUID: ETMsEfaPQ+iksuaTQbdOuA== X-IronPort-AV: E=McAfee;i="6800,10657,11939"; a="1085712" X-IronPort-AV: E=Sophos;i="6.27,167,1787036400"; d="scan'208";a="1085712" Received: from fmviesa007.fm.intel.com ([10.60.135.147]) by orvoesa109.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 19 Oct 2026 00:16:45 -0700 X-CSE-ConnectionGUID: owzB0WIgSRWF0Y5FZHK3xA== X-CSE-MsgGUID: 3BG9jdATSv68t8XBWMAbUg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.27,167,1787036400"; d="scan'208";a="2807238" Received: from spr.sh.intel.com ([10.112.229.196]) by fmviesa007.fm.intel.com with ESMTP; 19 Oct 2026 00:16:40 -0700 From: Dapeng Mi To: Peter Zijlstra , Ingo Molnar , Arnaldo Carvalho de Melo , Namhyung Kim , Ian Rogers , Adrian Hunter , Alexander Shishkin , Andi Kleen , Eranian Stephane , Sandipan Das , Andrii Nakryiko , Song Liu , Ravi Bangoria , Ananth Narayan Cc: linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, bpf@vger.kernel.org, Dapeng Mi , Zide Chen , Falcon Thomas , Xudong Hao , Sashiko , Dapeng Mi Subject: [Patch v3 2/4] perf/x86/amd/lbr: Limit branch snapshots to valid entries Date: Mon, 19 Oct 2026 15:08:34 +0800 Message-Id: <20261019070836.2972403-3-dapeng1.mi@linux.intel.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20261019070836.2972403-1-dapeng1.mi@linux.intel.com> References: <20261019070836.2972403-1-dapeng1.mi@linux.intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Sandipan Das The branch snapshot callback used by bpf_get_branch_snapshot() copies up to x86_pmu.lbr_nr entries from cpuc->lbr_entries[], even when the last LBR read kept fewer branches. The entries past lbr_stack.nr are invalid, but they end up reaching BPF programs. Limit copying to lbr_stack.nr entries and also reset lbr_stack.nr when amd_pmu_lbr_read() skips reading the registers, so that a stale count is never reused. Fixes: a4d18112e531 ("perf/x86/amd: Support capturing LBR from software events") Reported-by: Sashiko Closes: https://lore.kernel.org/all/sashiko-outbox-163130@kernel.org/ Signed-off-by: Sandipan Das Reviewed-by: Dapeng Mi Signed-off-by: Dapeng Mi --- arch/x86/events/amd/core.c | 2 +- arch/x86/events/amd/lbr.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c index 49b6b8fce566..bf631f60757c 100644 --- a/arch/x86/events/amd/core.c +++ b/arch/x86/events/amd/core.c @@ -944,7 +944,7 @@ static int amd_pmu_v2_snapshot_branch_stack(struct perf_branch_entry *entries, u cpuc = this_cpu_ptr(&cpu_hw_events); amd_pmu_lbr_read(); - cnt = min(cnt, x86_pmu.lbr_nr); + cnt = min(cnt, cpuc->lbr_stack.nr); memcpy(entries, cpuc->lbr_entries, sizeof(struct perf_branch_entry) * cnt); amd_pmu_v2_enable_all(0); diff --git a/arch/x86/events/amd/lbr.c b/arch/x86/events/amd/lbr.c index a55646fcb846..6c93b8042c73 100644 --- a/arch/x86/events/amd/lbr.c +++ b/arch/x86/events/amd/lbr.c @@ -168,8 +168,10 @@ void amd_pmu_lbr_read(void) struct branch_entry entry; int out = 0, idx, i; - if (!cpuc->lbr_users) + if (!cpuc->lbr_users) { + cpuc->lbr_stack.nr = 0; return; + } for (i = 0; i < x86_pmu.lbr_nr; i++) { entry.from.full = amd_pmu_lbr_get_from(i); -- 2.34.1