[PATCH] perf: Fix JSON output crash with intel_pt// samples

[PATCH] perf: Fix JSON output crash with intel_pt// samples

[James O. D. Hunt]

Current behaviour:

```bash
$ perf record -e intel_pt// true
$ perf data convert --to-json /tmp/perf.json
Segmentation fault (core dumped)
```

With fix applied:

```bash
$ perf record -e intel_pt// true
$ perf data convert --to-json /tmp/perf.json
$ jq < /tmp/perf.json &>/dev/null && echo ok
ok
```

The crash actually occurs in `intel_pt_process_auxtrace_info()` where
`session->itrace_synth_opts->set` is unconditionally dereferenced. This
platform-specific code could be changed to fix the issue, but this patch
fixes the problem generally.

Fixes: f6986c95af84ff2a76847910b4322f542b793bbf ("perf session: Add instruction tracing options")
Signed-off-by: James O. D. Hunt <james.o.hunt@intel.com>
---
 tools/perf/util/data-convert-json.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tools/perf/util/data-convert-json.c b/tools/perf/util/data-convert-json.c
index d9f805bf6fb0..b0aaa23659a0 100644
--- a/tools/perf/util/data-convert-json.c
+++ b/tools/perf/util/data-convert-json.c
@@ -326,6 +326,10 @@ int bt_convert__perf2json(const char *input_name, const char *output_name,
 		.force = opts->force,
 	};
 
+	struct itrace_synth_opts itrace_synth_opts = {
+		.set = 0,
+	};
+
 	perf_tool__init(&c.tool, /*ordered_events=*/true);
 	c.tool.sample         = process_sample_event;
 	c.tool.mmap           = perf_event__process_mmap;
@@ -377,6 +381,8 @@ int bt_convert__perf2json(const char *input_name, const char *output_name,
 		goto err_fclose;
 	}
 
+	session->itrace_synth_opts = &itrace_synth_opts;
+
 	if (symbol__init(&session->header.env) < 0) {
 		fprintf(stderr, "Symbol init error!\n");
 		goto err_session_delete;
-- 
2.49.0

Re: [PATCH] perf: Fix JSON output crash with intel_pt// samples

[Adrian Hunter]

Subject usually contains the relevant perf command.
e.g.
	perf data: Fix JSON output crash with intel_pt// samples
or
	perf data convert: Fix JSON output crash with intel_pt// samples

On 7/04/25 19:22, James O. D. Hunt wrote:
> Current behaviour:
> 
> ```bash

Might want to go easy on the backticks.

> $ perf record -e intel_pt// true
> $ perf data convert --to-json /tmp/perf.json
> Segmentation fault (core dumped)
> ```
> 
> With fix applied:
> 
> ```bash
> $ perf record -e intel_pt// true
> $ perf data convert --to-json /tmp/perf.json
> $ jq < /tmp/perf.json &>/dev/null && echo ok
> ok
> ```
> 
> The crash actually occurs in `intel_pt_process_auxtrace_info()` where
> `session->itrace_synth_opts->set` is unconditionally dereferenced. This
> platform-specific code could be changed to fix the issue, but this patch
> fixes the problem generally.
> 
> Fixes: f6986c95af84ff2a76847910b4322f542b793bbf ("perf session: Add instruction tracing options")

Full commit hash is not necessary and no one uses it for Fixes tags.
Should be 12+ characters but not much more.

Note it is the wrong commit.  The code was added by
commit d0713d4ca3e94 ("perf data: Add JSON export")

> Signed-off-by: James O. D. Hunt <james.o.hunt@intel.com>
> ---
>  tools/perf/util/data-convert-json.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/tools/perf/util/data-convert-json.c b/tools/perf/util/data-convert-json.c
> index d9f805bf6fb0..b0aaa23659a0 100644
> --- a/tools/perf/util/data-convert-json.c
> +++ b/tools/perf/util/data-convert-json.c
> @@ -326,6 +326,10 @@ int bt_convert__perf2json(const char *input_name, const char *output_name,
>  		.force = opts->force,
>  	};
>  
> +	struct itrace_synth_opts itrace_synth_opts = {
> +		.set = 0,
> +	};

The problem is that this sub-command sets up the auxtrace callbacks:

	c2c.tool.auxtrace_info  = perf_event__process_auxtrace_info;
	c2c.tool.auxtrace       = perf_event__process_auxtrace;
	c2c.tool.auxtrace_error = perf_event__process_auxtrace_error;

but not itrace options.

Other sub-commands either support the --itrace option:
	perf script
	perf report
	perf inject
	perf annotate
Or are limited to memory events only:
	perf c2c report
	perf mem report

In this case it looks like it should either support the --itrace
option or remove the auxtrace callbacks.

> +
>  	perf_tool__init(&c.tool, /*ordered_events=*/true);
>  	c.tool.sample         = process_sample_event;
>  	c.tool.mmap           = perf_event__process_mmap;
> @@ -377,6 +381,8 @@ int bt_convert__perf2json(const char *input_name, const char *output_name,
>  		goto err_fclose;
>  	}
>  
> +	session->itrace_synth_opts = &itrace_synth_opts;
> +
>  	if (symbol__init(&session->header.env) < 0) {
>  		fprintf(stderr, "Symbol init error!\n");
>  		goto err_session_delete;