Fix the API-level fdarray filtering logic in fdarray__filter() following
the integration of the system-wide recording teardown fix. Rather than
bypassing the evaluation loop entirely for nonfilterable file
descriptors (which accidentally skips calling registered entry
destructors for control pipes and wakeup FDs, while creating poll storms
and reference leaks for system-wide events that also have nonfilterable
set), separate the lifecycle and masking logic.

Reorder the filtering sequence so that registered entry destructors are
safely executed first for all file descriptors. Then, utilize the
fdarray_flag__non_perf_event flag to perfectly distinguish and bypass
destructive file descriptor zeroing (.fd = -1) and revents mask
clearing for background control pipes and timers. This allows system-wide
event file descriptors to be correctly destroyed, zeroed, and filtered out upon
receiving POLLHUP/POLLERR signals without triggering busy loops, while safely
preserving control pipe teardown signaling and destructors.

Fixes: fb4751e79c45 ("perf record: Fix teardown hang on system-wide multi-threaded sessions")
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Ian Rogers <irogers@google.com>
---
 tools/lib/api/fd/array.c    | 6 +++---
 tools/perf/builtin-record.c | 4 +++-
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/tools/lib/api/fd/array.c b/tools/lib/api/fd/array.c
index 16a047f1906e..92d9a3fb652c 100644
--- a/tools/lib/api/fd/array.c
+++ b/tools/lib/api/fd/array.c
@@ -115,9 +115,6 @@ int fdarray__filter(struct fdarray *fda, short revents,
 		return 0;
 
 	for (fd = 0; fd < fda->nr; ++fd) {
-		if (fda->priv[fd].flags & fdarray_flag__nonfilterable)
-			continue;
-
 		if (!fda->entries[fd].events)
 			continue;
 
@@ -125,6 +122,9 @@ int fdarray__filter(struct fdarray *fda, short revents,
 			if (entry_destructor)
 				entry_destructor(fda, fd, arg);
 
+			if (fda->priv[fd].flags & fdarray_flag__non_perf_event)
+				continue;
+
 			/*
 			 * Set fd to -1 so poll() ignores this entry; otherwise
 			 * POLLHUP/POLLERR are still reported for events=0 fds
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index f58d7e3c7879..c6644dab1cfb 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -1242,7 +1242,9 @@ static int record__alloc_thread_data(struct record *rec, struct evlist *evlist)
 				goto out_free;
 			}
 			ret = fdarray__add(&thread_data[t].pollfd, thread_data[t].pipes.msg[0],
-					   POLLIN | POLLERR | POLLHUP, fdarray_flag__nonfilterable);
+					   POLLIN | POLLERR | POLLHUP,
+					   fdarray_flag__nonfilterable |
+					   fdarray_flag__non_perf_event);
 			if (ret < 0) {
 				pr_err("Failed to add descriptor to thread[%d] pollfd\n", t);
 				goto out_free;
-- 
2.55.0.141.g00534a21ce-goog

When processing POLLHUP or POLLERR for an event in fdarray__filter, the
function invokes its destructor callback but fails to re-inject the
nonfilterable exclusion masks into the active event count (nr) increment
condition. Because auxiliary and control pipe descriptors never enter the
POLLHUP event match block, their active event count is unconditionally
incremented, preventing the return value from reaching zero on target
process exit and trapping __cmd_record() in an infinite drain poll hang.

Fix it by applying both fdarray_flag__nonfilterable and
fdarray_flag__non_perf_event exclusion masks into the active event
counter increment block at the bottom of the filtering loop.

Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Ian Rogers <irogers@google.com>
---
 tools/lib/api/fd/array.c    | 10 ++++++----
 tools/perf/builtin-record.c |  4 +++-
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/tools/lib/api/fd/array.c b/tools/lib/api/fd/array.c
index 67b73481df27..f97afbd6f07a 100644
--- a/tools/lib/api/fd/array.c
+++ b/tools/lib/api/fd/array.c
@@ -116,9 +116,6 @@ int fdarray__filter(struct fdarray *fda, short revents,
 		return 0;
 
 	for (fd = 0; fd < fda->nr; ++fd) {
-		if (fda->priv[fd].flags & fdarray_flag__nonfilterable)
-			continue;
-
 		if (!fda->entries[fd].events)
 			continue;
 
@@ -126,6 +123,9 @@ int fdarray__filter(struct fdarray *fda, short revents,
 			if (entry_destructor)
 				entry_destructor(fda, fd, arg);
 
+			if (fda->priv[fd].flags & fdarray_flag__non_perf_event)
+				continue;
+
 			/*
 			 * Set fd to -1 so poll() ignores this entry; otherwise
 			 * POLLHUP/POLLERR are still reported for events=0 fds
@@ -136,7 +136,9 @@ int fdarray__filter(struct fdarray *fda, short revents,
 			continue;
 		}
 
-		++nr;
+		if (!(fda->priv[fd].flags & fdarray_flag__nonfilterable) &&
+		    !(fda->priv[fd].flags & fdarray_flag__non_perf_event))
+			++nr;
 	}
 
 	return nr;
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index f58d7e3c7879..c6644dab1cfb 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -1242,7 +1242,9 @@ static int record__alloc_thread_data(struct record *rec, struct evlist *evlist)
 				goto out_free;
 			}
 			ret = fdarray__add(&thread_data[t].pollfd, thread_data[t].pipes.msg[0],
-					   POLLIN | POLLERR | POLLHUP, fdarray_flag__nonfilterable);
+					   POLLIN | POLLERR | POLLHUP,
+					   fdarray_flag__nonfilterable |
+					   fdarray_flag__non_perf_event);
 			if (ret < 0) {
 				pr_err("Failed to add descriptor to thread[%d] pollfd\n", t);
 				goto out_free;
-- 
2.55.0.229.g6434b31f56-goog