Some file systems like FUSE-based ones or overlayfs may record the backing
file in struct vm_area_struct vm_file, instead of the user file that the
user mmapped.

Since commit def3ae83da02f ("fs: store real path instead of fake path in
backing file f_path"), file_path() no longer returns the user file path
when applied to a backing file.  There is an existing helper
file_user_path() for that situation.

Use file_user_path() instead of file_path() to get the path for MMAP
and MMAP2 events.

Example:

  Setup:

    # cd /root
    # mkdir test ; cd test ; mkdir lower upper work merged
    # cp `which cat` lower
    # mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merged
    # perf record -e intel_pt//u -- /root/test/merged/cat /proc/self/maps
    ...
    55b0ba399000-55b0ba434000 r-xp 00018000 00:1a 3419                       /root/test/merged/cat
    ...
    [ perf record: Woken up 1 times to write data ]
    [ perf record: Captured and wrote 0.060 MB perf.data ]
    #

  Before:

    File name is wrong (/cat), so decoding fails:

    # perf script --no-itrace --show-mmap-events
             cat     367 [016]   100.491492: PERF_RECORD_MMAP2 367/367: [0x55b0ba399000(0x9b000) @ 0x18000 00:02 3419 489959280]: r-xp /cat
    ...
    # perf script --itrace=e | wc -l
    Warning:
    19 instruction trace errors
    19
    #

  After:

    File name is correct (/root/test/merged/cat), so decoding is ok:

    # perf script --no-itrace --show-mmap-events
                 cat     364 [016]    72.153006: PERF_RECORD_MMAP2 364/364: [0x55ce4003d000(0x9b000) @ 0x18000 00:02 3419 3132534314]: r-xp /root/test/merged/cat
    # perf script --itrace=e
    # perf script --itrace=e | wc -l
    0
    #

Fixes: def3ae83da02f ("fs: store real path instead of fake path in backing file f_path")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
---
 kernel/events/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 184f3dc7b03b..e203b8d90fd2 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -9416,7 +9416,7 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
 		 * need to add enough zero bytes after the string to handle
 		 * the 64bit alignment we do later.
 		 */
-		name = file_path(file, buf, PATH_MAX - sizeof(u64));
+		name = d_path(file_user_path(file), buf, PATH_MAX - sizeof(u64));
 		if (IS_ERR(name)) {
 			name = "//toolong";
 			goto cpy_name;
-- 
2.48.1

On Tue, Sep 9, 2025 at 2:42 PM Adrian Hunter <adrian.hunter@intel.com> wrote:
>
> Some file systems like FUSE-based ones or overlayfs may record the backing
> file in struct vm_area_struct vm_file, instead of the user file that the
> user mmapped.
>
> Since commit def3ae83da02f ("fs: store real path instead of fake path in
> backing file f_path"), file_path() no longer returns the user file path
> when applied to a backing file.  There is an existing helper
> file_user_path() for that situation.
>
> Use file_user_path() instead of file_path() to get the path for MMAP
> and MMAP2 events.
>
> Example:
>
>   Setup:
>
>     # cd /root
>     # mkdir test ; cd test ; mkdir lower upper work merged
>     # cp `which cat` lower
>     # mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merged
>     # perf record -e intel_pt//u -- /root/test/merged/cat /proc/self/maps
>     ...
>     55b0ba399000-55b0ba434000 r-xp 00018000 00:1a 3419                       /root/test/merged/cat
>     ...
>     [ perf record: Woken up 1 times to write data ]
>     [ perf record: Captured and wrote 0.060 MB perf.data ]
>     #
>
>   Before:
>
>     File name is wrong (/cat), so decoding fails:
>
>     # perf script --no-itrace --show-mmap-events
>              cat     367 [016]   100.491492: PERF_RECORD_MMAP2 367/367: [0x55b0ba399000(0x9b000) @ 0x18000 00:02 3419 489959280]: r-xp /cat
>     ...
>     # perf script --itrace=e | wc -l
>     Warning:
>     19 instruction trace errors
>     19
>     #
>
>   After:
>
>     File name is correct (/root/test/merged/cat), so decoding is ok:
>
>     # perf script --no-itrace --show-mmap-events
>                  cat     364 [016]    72.153006: PERF_RECORD_MMAP2 364/364: [0x55ce4003d000(0x9b000) @ 0x18000 00:02 3419 3132534314]: r-xp /root/test/merged/cat
>     # perf script --itrace=e
>     # perf script --itrace=e | wc -l
>     0
>     #
>
> Fixes: def3ae83da02f ("fs: store real path instead of fake path in backing file f_path")
> Cc: stable@vger.kernel.org
> Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>

Feel free to add
Acked-by: Amir Goldstein <amir73il@gmail.com>

Thanks,
Amir.

> ---
>  kernel/events/core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index 184f3dc7b03b..e203b8d90fd2 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -9416,7 +9416,7 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
>                  * need to add enough zero bytes after the string to handle
>                  * the 64bit alignment we do later.
>                  */
> -               name = file_path(file, buf, PATH_MAX - sizeof(u64));
> +               name = d_path(file_user_path(file), buf, PATH_MAX - sizeof(u64));
>                 if (IS_ERR(name)) {
>                         name = "//toolong";
>                         goto cpy_name;
> --
> 2.48.1
>