linux-next.git/tools/lib/api/fd, branch master

perf record: Fix unhandled POLLHUP on non_perf_event descriptors

2026-09-17T15:27:34+00:00

When processing POLLHUP on a non_perf_event control descriptor, evlist__finalize_ctlfd() is invoked to finalize the setup, correctly setting the core evlist's poll array file descriptor to -1. However, this finalized teardown state is never propagated back to the individual thread's local replica of the pollfd array. Consequently, on the next iteration of the main recording loop, record__update_evlist_pollfd_from_thread() performs a strict equivalence check between the core evlist's array and the thread's localized poll array, detecting that the fd values no longer match. This causes an immediate -EINVAL abort and a premature teardown. Fix the underlying logic within record__update_evlist_pollfd_from_thread() to sustainably propagate the finalized teardown statuses (-1) originating from the core evlist back to the thread's localized poll structure. This correctly maintains synchronization and entirely prevents the unhandled index mismatch crashes. Additionally, add a unit test that explicitly validates that fdarray__filter() preserves its invariants regarding fdarray_flag__nonfilterable items to guard against regressions. Fixes: fb4751e79c45cb48 ("perf record: Fix teardown hang on system-wide multi-threaded sessions") Signed-off-by: Ian Rogers Assisted-by: Gemini:gemini-3.1-pro Cc: Namhyung Kim Signed-off-by: Arnaldo Carvalho de Melo

tools/lib/api: Fix potential double-free from fdarray__grow()

2026-07-16T16:56:47+00:00

If the realloc for fda->entries succeeds but the realloc for fda->priv fails, the error path frees the newly allocated entries. However, fda->entries is neither updated to point to the new entries block nor cleared to NULL. If realloc moved the allocation to a new block, the old fda->entries pointer is now freed memory. When fdarray__exit() is later called to clean up, it executes free(fda->entries), which would trigger a double-free on that old pointer. Reported-by: Sashiko Review Closes: https://lore.kernel.org/linux-perf-users/20260710200150.11FE71F00A3A@smtp.kernel.org Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim

perf record: Fix teardown hang on system-wide multi-threaded sessions

2026-07-10T22:30:05+00:00

Under system-wide (-a) parallel streaming mode (--threads=cpu), background recording threads can be inundated by a continuous firehose of hardware samples generated by the OS. In this state, a background thread's local hit count remains unequal to its sample count, causing it to bypass the blocking fdarray__poll() call entirely on each iteration of its recording loop. Because the termination check relies on the POLLHUP event status populated specifically by fdarray__poll(), bypassing it prevents the background thread from ever recognizing that its control pipe was closed by the main thread. This traps the background thread in an infinite recording loop, hanging the main thread indefinitely as it awaits a termination acknowledgment that never arrives. Ensure teardown completion by adding explicit evlist__disable() calls in the main thread's cleanup paths at out_child: and out_child_no_flush:. Additionally, patch fdarray__filter() to respect the fdarray_flag__nonfilterable flag, preventing it from incorrectly setting the background thread's control pipe file descriptor to -1 and clearing its revents mask upon processing termination POLLHUP signals. Fixes: f94563fac269 ("perf record: fix poll storm when monitored threads exit") Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim

perf record: fix poll storm when monitored threads exit

2026-07-08T05:59:07+00:00

When `perf record` samples a multi-threaded process and one of the target threads exits during the session, perf itself may start burning 100% CPU (up to 200% across two cores) until the session ends. A single dead fd is sufficient to trigger this; it can be reproduced with 15 pthreads in a compute loop where one thread exits halfway through. The root cause is two independent instances of the same defect: dead perf_event ring-buffer fds are left in a pollfd array. When a monitored thread exits, the kernel closes its ring-buffer fd, which then returns POLLHUP. POSIX specifies that poll() always reports POLLHUP and POLLERR regardless of the events mask, so any dead fd left in the array makes poll() return immediately every time, spinning in a tight loop: 3 seconds: 256,600 poll() calls, 0 context switches, only 21 write() Woken up count goes from ~0 to 1,300,000+ There are two affected poll paths, fixed together here: 1. Record main loop, via fdarray__filter() (tools/lib/api/fd/array.c). Since commit 59b4412f27f1 ("libperf: Avoid internal moving of fdarray fds") it only zeroes events/revents without setting fd to -1, so poll() keeps reporting POLLHUP for the entry. Setting fd = -1 makes poll() skip it, matching the pattern already used in the control-fd path at tools/perf/builtin-record.c:1673. 2. BPF sideband thread, perf_evlist__poll_thread() (tools/perf/util/sideband_evlist.c). This thread polls for PERF_RECORD_BPF_EVENT but, unlike the main record loop, never calls fdarray__filter() at all, so dead fds accumulate forever and it spins at 100% CPU: Before fix: dJiffies=101, wchan=0 (running) After fix: dJiffies=0, wchan=do_sys_poll (blocking) Fixed by calling the existing evlist__filter_pollfd() helper after evlist__poll(), mirroring the main record loop. is included for the POLLERR/POLLHUP macros (previously unused there). The two fixes compose: fix 1 makes poll() ignore dead fds (fd=-1); fix 2 ensures the sideband thread actually performs the filtering. Both paths are affected in all kernels from v5.1/v5.9 to the current master (7.2-rc1); the source of both functions is byte-identical across them. BPF event recording is preserved: after the fix, perf.data still contains PERF_RECORD_BPF_EVENT records and bpf_prog_info entries. Verified on perf 6.1.76, 6.6.143 and 7.2-rc1 with a minimal reproducer (Woken up 1,300,000 -> 3, CPU 100% -> 0%) and an A/B orthogonal test: keeping the unpatched binary but preventing the target thread from exiting also makes the storm disappear, confirming the trigger. Fixes: 59b4412f27f1 ("libperf: Avoid internal moving of fdarray fds") Fixes: 657ee5531903 ("perf evlist: Introduce side band thread") Signed-off-by: Jiawei Sun Reviewed-by: Ian Rogers Signed-off-by: Namhyung Kim

perf record: Fix way of handling non-perf-event pollfds

2022-10-04T11:55:19+00:00

perf record __cmd_record() does not poll evlist pollfds. Instead it polls thread_data[0].pollfd. That happens whether or not threads are being used. perf record duplicates evlist mmap pollfds as needed for separate threads. The non-perf-event represented by evlist->ctl_fd has to handled separately, which is done explicitly, duplicating it into the thread_data[0] pollfds. That approach neglects any other non-perf-event file descriptors. Currently there is also done_fd which needs the same handling. Add a new generalized approach. Add fdarray_flag__non_perf_event to identify the file descriptors that need the special handling. For those cases, also keep a mapping of the evlist pollfd index and thread pollfd index, so that the evlist revents can be updated. Although this patch adds the new handling, it does not take it into use. There is no functional change, but it is the precursor to a fix, so is marked as a fix. Fixes: 415ccb58f68a6beb ("perf record: Introduce thread specific data array") Signed-off-by: Adrian Hunter Acked-by: Ian Rogers Cc: Alexey Bayduraev Cc: Andi Kleen Cc: Jiri Olsa Cc: Namhyung Kim Link: https://lore.kernel.org/r/20220824072814.16422-2-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo

tools lib: Introduce fdarray duplicate function

2022-02-10T19:25:20+00:00

Introduce a function to duplicate an existing file descriptor in the fdarray structure. The function returns the position of the duplicated file descriptor. Reviewed-by: Riccardo Mancini Signed-off-by: Alexey Bayduraev Tested-by: Jiri Olsa Tested-by: Riccardo Mancini Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Alexander Antonov Cc: Alexander Shishkin Cc: Alexei Budankov Cc: Andi Kleen Cc: Ingo Molnar Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/2891f1def287d5863cc82683a4d5879195c8d90c.1642440724.git.alexey.v.bayduraev@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo

libperf: Avoid counting of nonfilterable fdarray fds

2020-07-21T12:53:22+00:00

Avoid counting of struct pollfd *entries objects with fdarray_flag__nonfilterable flag by fdarray__filter(). Nonfilterable objects are still processed if requested revents have been signaled for them. Signed-off-by: Alexey Budankov Acked-by: Jiri Olsa Acked-by: Namhyung Kim Cc: Alexander Shishkin Cc: Andi Kleen Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/b5ab0d2c-b742-0032-e8d3-c8e2eb423c42@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo

libperf: Add flags to fdarray fds objects

2020-07-21T12:52:51+00:00

Store flags per struct pollfd *entries object in a bitmap of int size. Implement fdarray_flag__nonfilterable flag to skip object from counting by fdarray__filter(). Fixed fdarray test issue reported by kernel test robot. Reported-by: kernel test robot Signed-off-by: Alexey Budankov Acked-by: Jiri Olsa Acked-by: Namhyung Kim Cc: Alexander Shishkin Cc: Andi Kleen Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/6b7d43ff-0801-d5dd-4e90-fcd86b17c1c8@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo

libperf: Avoid internal moving of fdarray fds

2020-07-21T11:49:30+00:00

Avoid moving of fds by fdarray__filter() so fds indices returned by fdarray__add() can be used for access and processing of objects at struct pollfd *entries. Signed-off-by: Alexey Budankov Acked-by: Jiri Olsa Acked-by: Namhyung Kim Cc: Alexander Shishkin Cc: Andi Kleen Cc: Peter Zijlstra Link: http://lore.kernel.org/lkml/676844f8-55d3-c628-23db-aa163a81519e@linux.intel.com Signed-off-by: Arnaldo Carvalho de Melo

treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 251

2019-06-05T15:30:26+00:00

Based on 1 normalized pattern(s): released under the gpl v2 and only v2 not any later version extracted by the scancode license scanner the SPDX license identifier GPL-2.0-only has been chosen to replace the boilerplate/reference in 12 file(s). Signed-off-by: Thomas Gleixner Reviewed-by: Steve Winslow Reviewed-by: Alexios Zavras Reviewed-by: Kate Stewart Reviewed-by: Allison Randal Cc: linux-spdx@vger.kernel.org Link: https://lkml.kernel.org/r/20190529141332.526460839@linutronix.de Signed-off-by: Greg Kroah-Hartman