From nobody Sun Jun 14 12:43:49 2026 Received: from mail-dl1-f73.google.com (mail-dl1-f73.google.com [74.125.82.73]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A95E0346766 for ; Sat, 4 Apr 2026 06:05:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.73 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775282760; cv=none; b=qeuKNK2G6zMUc7B6jwOOvGUvWmK32dSNAb3AtalragaeIXLsyoC/QrQrOce69Osf+r3bd2x2jL3gB6jiNewSSZvLufTqy/zdPRsxqXHQXAFz4i0BKyWxmqxOWmFQOh+7caPkKVXvz1dCIfVVkLLAP5m/dqh8DykVUobEAEbVVt4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775282760; c=relaxed/simple; bh=kmXSmd/gwaoO5SjElYAn3EVfet98k9hAMaeX2WrIEg8=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=fwYzFFPc7B9zZmnQJRkANacokoQYNIl4Z89lte+4w0f5Atsk6a6KL34AR4mqfeYKZQb4LrY8L2zvrLwyN1cSilw7oO1ZKpWAvFMswW4ZvzAqHGLFfuyCbfK7nMfgtmUVzfYWKep+P8ARvEjBA3qn4i49ObiPnEPcpS0lFnFJpwQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--irogers.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=NDJ2Mw84; arc=none smtp.client-ip=74.125.82.73 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--irogers.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="NDJ2Mw84" Received: by mail-dl1-f73.google.com with SMTP id a92af1059eb24-12737f276a2so4212137c88.1 for ; Fri, 03 Apr 2026 23:05:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1775282757; x=1775887557; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=ZmBxcmCr+2314ATKNVK327TwY//Umu/8RElIuAEXl1A=; b=NDJ2Mw84BQ2oNSKLsHSHtyL5XpCkze7tnE8rXtsN73LHuO2o6gsOcXmaHOkdmbEXRA bIs4q+7PvzWnckpPyUc5nasEpOhjVpRvQKOpLxjZKRXK9PFMuRaXKpgfuVCXWjTUWJX7 tqFP0z5oxmD+8kekhjHAZldLHFOtqwK7XtiYV5YB5iUoVIoxXmlIoG33TXFoJPau8W9T 20or5mIzc7KSaoMhQrHyYpFD6CsfENaq6T6VPU6q8XGmdERSlMpAmx0kwS9yzc8h8c6R jNyn61xNYQVjQxvL/ELGL3w3665FQ/F8EUdsfQRJnj3+v+p3t/wZjEXM2n4kqwsWEMwN vzvA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775282757; x=1775887557; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=ZmBxcmCr+2314ATKNVK327TwY//Umu/8RElIuAEXl1A=; b=ni8fZZbehmgmbHwRaRKXKRfp3gnLAjQsgi4VbNrEO0NhgYNFghPcLytGuMUoLBkjCT tgf8dZvZCYxRsgvCAT1FwA4uQdecA3HTrTkg55D8jFEcx4dv3OLGLy1G56jKquB1FwT4 is55WOCCLK7e+TDvRGiLzB/DUZ4m0Tiv9zdpvX6DwRDQm3q8+46W7M97YEbFnyPVs0cB 5kEuE/DFpWIBQotoLjjvIfpBa4N8LZdjWXKaeAAu6vddDgRmAXwzjF2C7bP3JnyqofSe XHwisDkd+fFDw7kIa6nM5e3IUOwwqMjdVIy+SsVdfh+FpF7gziB9tx4Bw7higsi17Ev1 gIHw== X-Forwarded-Encrypted: i=1; AJvYcCU573+GLfvBBb8TrUsV3ro2G9rBgGSFmddpMUy7SqEOWkcgCXQhGMeqkrpCFyhfzyBdBbizRPQfWCN8/L0=@vger.kernel.org X-Gm-Message-State: AOJu0YwVHGgHzJuqvoyCSkeHvdrqLit8BS22/Dyz3/OxWcJjdGsqG3y/ sfcKBfm//Az6D8/s02hUV13JGJmnXoK+cYROnr/pI2KSjOjKAAudrOYmu+e5r1K+mq68rd4xZcf OViVmKM1MUQ== X-Received: from dlai16.prod.google.com ([2002:a05:701b:2710:b0:12a:7a12:4f3f]) (user=irogers job=prod-delivery.src-stubby-dispatcher) by 2002:a05:7022:ec17:b0:12b:ebb8:e518 with SMTP id a92af1059eb24-12bfb779d53mr2312811c88.35.1775282756530; Fri, 03 Apr 2026 23:05:56 -0700 (PDT) Date: Fri, 3 Apr 2026 23:05:52 -0700 In-Reply-To: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: X-Mailer: git-send-email 2.53.0.1213.gd9a14994de-goog Message-ID: <20260404060552.1585709-1-irogers@google.com> Subject: [PATCH v2] perf cgroup: Update metric leader in evlist__expand_cgroup From: Ian Rogers To: acme@kernel.org, namhyung@kernel.org Cc: irogers@google.com, adrian.hunter@intel.com, alexander.shishkin@linux.intel.com, bpf@vger.kernel.org, james.clark@linaro.org, jolsa@kernel.org, linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, mingo@redhat.com, peterz@infradead.org, sun.jian.kdev@gmail.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When the evlist is expanded the metric leader wasn't being updated. As the original evsel is deleted this creates a use-after-free in stat-shadow's prepare_metric. This was detected running the "perf stat --bpf-counters --for-each-cgroup test" with sanitizers. The change itself puts the copied evsel into the priv field (known unused because of evsel__clone use) and then in a second pass over the list updates the copied values using the priv pointer. Fixes: d1c5a0e86a4e ("perf stat: Add --for-each-cgroup option") Signed-off-by: Ian Rogers Acked-by: Sun Jian --- v2: Take better care over evsel vs perf_evsel (Sun Jian) --- tools/perf/util/cgroup.c | 30 +++++++++++++++++++++++------- 1 file changed, 23 insertions(+), 7 deletions(-) diff --git a/tools/perf/util/cgroup.c b/tools/perf/util/cgroup.c index 040eb75f0804..1b5664d1481f 100644 --- a/tools/perf/util/cgroup.c +++ b/tools/perf/util/cgroup.c @@ -417,7 +417,6 @@ static bool has_pattern_string(const char *str) int evlist__expand_cgroup(struct evlist *evlist, const char *str, bool ope= n_cgroup) { struct evlist *orig_list, *tmp_list; - struct evsel *pos, *evsel, *leader; struct rblist orig_metric_events; struct cgroup *cgrp =3D NULL; struct cgroup_name *cn; @@ -452,6 +451,7 @@ int evlist__expand_cgroup(struct evlist *evlist, const = char *str, bool open_cgro goto out_err; =20 list_for_each_entry(cn, &cgroup_list, list) { + struct evsel *pos; char *name; =20 if (!cn->used) @@ -467,21 +467,37 @@ int evlist__expand_cgroup(struct evlist *evlist, cons= t char *str, bool open_cgro if (cgrp =3D=3D NULL) continue; =20 - leader =3D NULL; + /* copy the list and set to the new cgroup. */ evlist__for_each_entry(orig_list, pos) { - evsel =3D evsel__clone(/*dest=3D*/NULL, pos); + struct evsel *evsel =3D evsel__clone(/*dest=3D*/NULL, pos); + if (evsel =3D=3D NULL) goto out_err; =20 + /* stash the copy during the copying. */ + pos->priv =3D evsel; cgroup__put(evsel->cgrp); evsel->cgrp =3D cgroup__get(cgrp); =20 - if (evsel__is_group_leader(pos)) - leader =3D evsel; - evsel__set_leader(evsel, leader); - evlist__add(tmp_list, evsel); } + /* update leader information using stashed pointer to copy. */ + evlist__for_each_entry(orig_list, pos) { + struct evsel *evsel =3D pos->priv; + + if (evsel__leader(pos)) + evsel__set_leader(evsel, evsel__leader(pos)->priv); + + if (pos->metric_leader) + evsel->metric_leader =3D pos->metric_leader->priv; + + if (pos->first_wildcard_match) + evsel->first_wildcard_match =3D pos->first_wildcard_match->priv; + } + /* the stashed copy is no longer used. */ + evlist__for_each_entry(orig_list, pos) + pos->priv =3D NULL; + /* cgroup__new() has a refcount, release it here */ cgroup__put(cgrp); nr_cgroups++; --=20 2.53.0.1213.gd9a14994de-goog