]> git.ipfire.org Git - thirdparty/kernel/linux.git/commitdiff
perf parse-events: Fix big-endian 'overwrite' by writing correct union member
authorThomas Richter <tmricht@linux.ibm.com>
Tue, 17 Feb 2026 13:14:56 +0000 (14:14 +0100)
committerArnaldo Carvalho de Melo <acme@redhat.com>
Tue, 17 Mar 2026 20:16:09 +0000 (17:16 -0300)
The "Read backward ring buffer" test crashes on big-endian (e.g. s390x)
due to a NULL dereference when the backward mmap path isn't enabled.

Reproducer:
  # ./perf test -F 'Read backward ring buffer'
  Segmentation fault (core dumped)
  # uname -m
  s390x
  #

Root cause:
get_config_terms() stores into evsel_config_term::val.val (u64) while later
code reads boolean fields such as evsel_config_term::val.overwrite.
On big-endian the 1-byte boolean is left-aligned, so writing
evsel_config_term::val.val = 1 is read back as
evsel_config_term::val.overwrite = 0,
leaving backward mmap disabled and a NULL map being used.

Store values in the union member that matches the term type, e.g.:
  /* for OVERWRITE */
  new_term->val.overwrite = 1;  /* not new_term->val.val = 1 */
to fix this. Improve add_config_term() and add two more parameters for
string and value. Function add_config_term() now creates a complete node
element of type evsel_config_term and handles all evsel_config_term::val
union members.

Impact:
Enables backward mmap on big-endian and prevents the crash.
No change on little-endian.

Output after:
 # ./perf test -Fv 44
 --- start ---
 Using CPUID IBM,9175,705,ME1,3.8,002f
 mmap size 1052672B
 mmap size 8192B
 ---- end ----
 44: Read backward ring buffer                         : Ok
 #

Fixes: 159ca97cd97ce8cc ("perf parse-events: Refactor get_config_terms() to remove macros")
Reviewed-by: James Clark <james.clark@linaro.org>
Reviewed-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Acked-by: Ian Rogers <irogers@google.com>
Cc: James Clark <james.clark@linaro.org>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
tools/perf/util/parse-events.c

index b9efb296bba51075fcdb090072df3b7a34a32f8b..7b4629625b1e6fd642ad247e02e285ee4a2f65f5 100644 (file)
@@ -1117,7 +1117,7 @@ static int config_attr(struct perf_event_attr *attr,
 
 static struct evsel_config_term *add_config_term(enum evsel_term_type type,
                                                 struct list_head *head_terms,
-                                                bool weak)
+                                                bool weak, char *str, u64 val)
 {
        struct evsel_config_term *t;
 
@@ -1128,8 +1128,62 @@ static struct evsel_config_term *add_config_term(enum evsel_term_type type,
        INIT_LIST_HEAD(&t->list);
        t->type = type;
        t->weak = weak;
-       list_add_tail(&t->list, head_terms);
 
+       switch (type) {
+       case EVSEL__CONFIG_TERM_PERIOD:
+       case EVSEL__CONFIG_TERM_FREQ:
+       case EVSEL__CONFIG_TERM_STACK_USER:
+       case EVSEL__CONFIG_TERM_USR_CHG_CONFIG:
+       case EVSEL__CONFIG_TERM_USR_CHG_CONFIG1:
+       case EVSEL__CONFIG_TERM_USR_CHG_CONFIG2:
+       case EVSEL__CONFIG_TERM_USR_CHG_CONFIG3:
+       case EVSEL__CONFIG_TERM_USR_CHG_CONFIG4:
+               t->val.val = val;
+               break;
+       case EVSEL__CONFIG_TERM_TIME:
+               t->val.time = val;
+               break;
+       case EVSEL__CONFIG_TERM_INHERIT:
+               t->val.inherit = val;
+               break;
+       case EVSEL__CONFIG_TERM_OVERWRITE:
+               t->val.overwrite = val;
+               break;
+       case EVSEL__CONFIG_TERM_MAX_STACK:
+               t->val.max_stack = val;
+               break;
+       case EVSEL__CONFIG_TERM_MAX_EVENTS:
+               t->val.max_events = val;
+               break;
+       case EVSEL__CONFIG_TERM_PERCORE:
+               t->val.percore = val;
+               break;
+       case EVSEL__CONFIG_TERM_AUX_OUTPUT:
+               t->val.aux_output = val;
+               break;
+       case EVSEL__CONFIG_TERM_AUX_SAMPLE_SIZE:
+               t->val.aux_sample_size = val;
+               break;
+       case EVSEL__CONFIG_TERM_CALLGRAPH:
+       case EVSEL__CONFIG_TERM_BRANCH:
+       case EVSEL__CONFIG_TERM_DRV_CFG:
+       case EVSEL__CONFIG_TERM_RATIO_TO_PREV:
+       case EVSEL__CONFIG_TERM_AUX_ACTION:
+               if (str) {
+                       t->val.str = strdup(str);
+                       if (!t->val.str) {
+                               zfree(&t);
+                               return NULL;
+                       }
+                       t->free_str = true;
+               }
+               break;
+       default:
+               t->val.val = val;
+               break;
+       }
+
+       list_add_tail(&t->list, head_terms);
        return t;
 }
 
@@ -1142,7 +1196,7 @@ static int get_config_terms(const struct parse_events_terms *head_config,
                struct evsel_config_term *new_term;
                enum evsel_term_type new_type;
                bool str_type = false;
-               u64 val;
+               u64 val = 0;
 
                switch (term->type_term) {
                case PARSE_EVENTS__TERM_TYPE_SAMPLE_PERIOD:
@@ -1234,20 +1288,15 @@ static int get_config_terms(const struct parse_events_terms *head_config,
                        continue;
                }
 
-               new_term = add_config_term(new_type, head_terms, term->weak);
+               /*
+                * Note: Members evsel_config_term::val and
+                * parse_events_term::val are unions and endianness needs
+                * to be taken into account when changing such union members.
+                */
+               new_term = add_config_term(new_type, head_terms, term->weak,
+                                          str_type ? term->val.str : NULL, val);
                if (!new_term)
                        return -ENOMEM;
-
-               if (str_type) {
-                       new_term->val.str = strdup(term->val.str);
-                       if (!new_term->val.str) {
-                               zfree(&new_term);
-                               return -ENOMEM;
-                       }
-                       new_term->free_str = true;
-               } else {
-                       new_term->val.val = val;
-               }
        }
        return 0;
 }
@@ -1277,10 +1326,9 @@ static int add_cfg_chg(const struct perf_pmu *pmu,
        if (bits) {
                struct evsel_config_term *new_term;
 
-               new_term = add_config_term(new_term_type, head_terms, false);
+               new_term = add_config_term(new_term_type, head_terms, false, NULL, bits);
                if (!new_term)
                        return -ENOMEM;
-               new_term->val.cfg_chg = bits;
        }
 
        return 0;