From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from dggsgout12.his.huawei.com (dggsgout12.his.huawei.com [45.249.212.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8527F3AEF55; Wed, 16 Sep 2026 01:30:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.56 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789522225; cv=none; b=Gkuuaa091A7xNtkTMXGZ0/LfutYN+4bPWTQEVqN5/MDHxdgl2Yd0vqax8+MQxOFO0wdTERyLSOTzSzNDFe3XpVPgQwdJ3s4TVgMO1+j54/EZwN8MY3i5P+R7eRYc/a7RA3D8E811mjoop2OaZTzLGnKE/naki8+0I8vp4jZyclo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789522225; c=relaxed/simple; bh=1LZAFEzm9aAr0LYn1MMN1korAsMJLY/yPRtAe4VBemQ=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=e0PUk38KABD40KOFCZiRhXUb6r+aRwfdETAmAolasCuSvt6x1ZFX46+ZtumYVcNSesmtJP93PVTOaEBLLIqZVLPTT4fLMhLuDsVYbzBzThnWM8C0pnvEfCGLB7rRaFME+SyU79DTdtAEsS8zfto6dxIfp54CWbRUCrCYxFEbGAI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com; spf=pass smtp.mailfrom=huaweicloud.com; arc=none smtp.client-ip=45.249.212.56 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huaweicloud.com Received: from mail.maildlp.com (unknown [172.19.163.177]) by dggsgout12.his.huawei.com (SkyGuard) with ESMTPS id 4hl1XK23Y8zKHMWl; Wed, 16 Sep 2026 09:29:53 +0800 (CST) Received: from mail02.huawei.com (unknown [10.116.40.128]) by mail.maildlp.com (Postfix) with ESMTP id DAE2040592; Wed, 16 Sep 2026 09:30:06 +0800 (CST) Received: from huawei.com (unknown [10.67.174.45]) by APP4 (Coremail) with UTF8SMTPA id gCh0CgAn+CoH8alqUcjbAQ--.36458S22; Wed, 16 Sep 2026 09:30:06 +0800 (CST) From: Tengda Wu To: Namhyung Kim , james.clark@linaro.org, xueshuai@linux.alibaba.com, Ian Rogers , Adrian Hunter Cc: Peter Zijlstra , leo.yan@linux.dev, Li Huafei , Kim Phillips , Mark Rutland , Arnaldo Carvalho de Melo , Ingo Molnar , Bill Wendling , Nick Desaulniers , Alexander Shishkin , Zecheng Li , linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org, llvm@lists.linux.dev, Tengda Wu Subject: [PATCH v6 20/26] perf annotate-x86: Delete stale stack state on store of untracked register Date: Wed, 16 Sep 2026 01:29:34 +0000 Message-Id: X-Mailer: git-send-email 2.34.1 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-CM-TRANSID:gCh0CgAn+CoH8alqUcjbAQ--.36458S22 X-Coremail-Antispam: 1UD129KBjvJXoWxur4xGry8KFyxKrWUGF4xCrg_yoW5KrW7pr yDC343Ww17Gr4SqrnxAFW5XF95Crs7X3WrC3s0qwn2vF1xJr1fGr97tFWYyF47Xr92kw12 yw1DKr4DJa1IgaDanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUH2b4IE77IF4wAFF20E14v26rWj6s0DM7CY07I20VC2zVCF04k2 6cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28IrcIa0xkI8VA2jI8067AKxVWUAV Cq3wA2048vs2IY020Ec7CjxVAFwI0_Xr0E3s1l8cAvFVAK0II2c7xJM28CjxkF64kEwVA0 rcxSw2x7M28EF7xvwVC0I7IYx2IY67AKxVW5JVW7JwA2z4x0Y4vE2Ix0cI8IcVCY1x0267 AKxVW8Jr0_Cr1UM28EF7xvwVC2z280aVAFwI0_Gr1j6F4UJwA2z4x0Y4vEx4A2jsIEc7Cj xVAFwI0_GcCE3s1le2I262IYc4CY6c8Ij28IcVAaY2xG8wAqx4xG64xvF2IEw4CE5I8CrV C2j2WlYx0E2Ix0cI8IcVAFwI0_Jr0_Jr4lYx0Ex4A2jsIE14v26r1j6r4UMcvjeVCFs4IE 7xkEbVWUJVW8JwACjcxG0xvY0x0EwIxGrwACjI8F5VA0II8E6IAqYI8I648v4I1lFIxGxc IEc7CjxVA2Y2ka0xkIwI1lc7CjxVAaw2AFwI0_GFv_Wrylc7CjxVAKzI0EY4vE52x082I5 MxAIw28IcxkI7VAKI48JMxC20s026xCaFVCjc4AY6r1j6r4UMI8I3I0E5I8CrVAFwI0_Jr 0_Jr4lx2IqxVCjr7xvwVAFwI0_JrI_JrWlx4CE17CEb7AF67AKxVW8ZVWrXwCIc40Y0x0E wIxGrwCI42IY6xIIjxv20xvE14v26ryj6F1UMIIF0xvE2Ix0cI8IcVCY1x0267AKxVW8Jr 0_Cr1UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWUCwCI42IY6I8E87Iv67AKxVW8JVWxJwCI 42IY6I8E87Iv6xkF7I0E14v26r4UJVWxJrUvcSsGvfC2KfnxnUUI43ZEXa7sRNg4S3UUUU U== X-CM-SenderInfo: pzxwv0hjgdqx5xdzvxpfor3voofrz/ When a register without a tracked type is stored to a stack slot that previously held a valid type, the code currently performs an early return. This leaves the old type information intact in the stack state. As a result, a stale type bug occurs: 1. A tracked register is stored into a stack slot. 2. The register becomes untracked/invalid (e.g., across a function call). 3. The now-untracked register is stored into the same stack slot. 4. Subsequent loads from that slot erroneously pick up the old stale type because the stack entry was never invalidated. Fix this by introducing delete_stack_state() to search and free a stack entry for a given offset. When storing an untracked or invalid source register into a stack location, call delete_stack_state() to delete the stale entry before returning. Signed-off-by: Tengda Wu --- tools/perf/util/annotate-arch/annotate-x86.c | 17 +++++++++++++---- tools/perf/util/annotate-data.c | 10 ++++++++++ tools/perf/util/annotate-data.h | 1 + 3 files changed, 24 insertions(+), 4 deletions(-) diff --git a/tools/perf/util/annotate-arch/annotate-x86.c b/tools/perf/util/annotate-arch/annotate-x86.c index 21729e153fa0..3a6ea7e978e0 100644 --- a/tools/perf/util/annotate-arch/annotate-x86.c +++ b/tools/perf/util/annotate-arch/annotate-x86.c @@ -753,15 +753,24 @@ static void update_insn_state_x86(struct type_state *state, } /* Case 3. register to memory transfers */ if (!src->mem_ref && dst->mem_ref) { - if (!has_reg_type(state, src->reg1) || - !state->regs[src->reg1].ok) - return; - /* Check stack variables with offset */ if (dst->reg1 == fbreg || dst->reg1 == state->stack_reg) { struct type_state_stack *stack; int offset = dst->offset - fboff; + if (!has_reg_type(state, src->reg1) || + !state->regs[src->reg1].ok) { + stack = find_stack_state(state, offset); + /* + * Preserve compound states when only a member + * is overwritten. + */ + if (stack && !stack->compound) + delete_stack_state(state, offset); + + return; + } + tsr = &state->regs[src->reg1]; stack = find_stack_state(state, offset); diff --git a/tools/perf/util/annotate-data.c b/tools/perf/util/annotate-data.c index 8bd9b6370277..9ca59bc2f841 100644 --- a/tools/perf/util/annotate-data.c +++ b/tools/perf/util/annotate-data.c @@ -651,6 +651,16 @@ struct type_state_stack *findnew_stack_state(struct type_state *state, return stack; } +void delete_stack_state(struct type_state *state, int offset) +{ + struct type_state_stack *stack = find_stack_state(state, offset); + + if (stack) { + list_del(&stack->list); + free(stack); + } +} + void invalidate_reg_state(struct type_state_reg *reg) { reg->kind = TSR_KIND_INVALID; diff --git a/tools/perf/util/annotate-data.h b/tools/perf/util/annotate-data.h index de92459e8502..a0d7e20ed725 100644 --- a/tools/perf/util/annotate-data.h +++ b/tools/perf/util/annotate-data.h @@ -259,6 +259,7 @@ void set_stack_state(struct type_state_stack *stack, int offset, u8 kind, Dwarf_Die *type_die, int ptr_offset, u64 imm_value); struct type_state_stack *find_stack_state(struct type_state *state, int offset); +void delete_stack_state(struct type_state *state, int offset); void invalidate_reg_state(struct type_state_reg *reg); bool get_global_var_type(Dwarf_Die *cu_die, struct data_loc_info *dloc, u64 ip, u64 var_addr, int *var_offset, -- 2.34.1