linux-kernel - [tip: perf/urgent] perf/core: Fix address filter match with backing files

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <176043133968.709179.15062959887826741046.tip-bot2@tip-bot2>
Date: Tue, 14 Oct 2025 08:42:19 -0000
From: "tip-bot2 for Adrian Hunter" <tip-bot2@...utronix.de>
To: linux-tip-commits@...r.kernel.org
Cc: Edd Barrett <edd@...unixzoo.co.uk>,
	Adrian Hunter <adrian.hunter@...el.com>,
	"Peter Zijlstra (Intel)" <peterz@...radead.org>,
	Amir Goldstein <amir73il@...il.com>, stable@...r.kernel.org,
	#@...-bot2.tec.linutronix.de, 6.8@...-bot2.tec.linutronix.de,
	x86@...nel.org, linux-kernel@...r.kernel.org
Subject:
 [tip: perf/urgent] perf/core: Fix address filter match with backing files

The following commit has been merged into the perf/urgent branch of tip:

Commit-ID:     ebfc8542ad62d066771e46c8aa30f5624b89cad8
Gitweb:        https://git.kernel.org/tip/ebfc8542ad62d066771e46c8aa30f5624b89cad8
Author:        Adrian Hunter <adrian.hunter@...el.com>
AuthorDate:    Mon, 13 Oct 2025 10:22:42 +03:00
Committer:     Peter Zijlstra <peterz@...radead.org>
CommitterDate: Tue, 14 Oct 2025 10:38:09 +02:00

perf/core: Fix address filter match with backing files

It was reported that Intel PT address filters do not work in Docker
containers.  That relates to the use of overlayfs.

overlayfs records the backing file in struct vm_area_struct vm_file,
instead of the user file that the user mmapped.  In order for an address
filter to match, it must compare to the user file inode.  There is an
existing helper file_user_inode() for that situation.

Use file_user_inode() instead of file_inode() to get the inode for address
filter matching.

Example:

  Setup:

    # cd /root
    # mkdir test ; cd test ; mkdir lower upper work merged
    # cp `which cat` lower
    # mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merged
    # perf record --buildid-mmap -e intel_pt//u --filter 'filter * @ /root/test/merged/cat' -- /root/test/merged/cat /proc/self/maps
    ...
    55d61d246000-55d61d2e1000 r-xp 00018000 00:1a 3418                       /root/test/merged/cat
    ...
    [ perf record: Woken up 1 times to write data ]
    [ perf record: Captured and wrote 0.015 MB perf.data ]
    # perf buildid-cache --add /root/test/merged/cat

  Before:

    Address filter does not match so there are no control flow packets

    # perf script --itrace=e
    # perf script --itrace=b | wc -l
    0
    # perf script -D | grep 'TIP.PGE' | wc -l
    0
    #

  After:

    Address filter does match so there are control flow packets

    # perf script --itrace=e
    # perf script --itrace=b | wc -l
    235
    # perf script -D | grep 'TIP.PGE' | wc -l
    57
    #

With respect to stable kernels, overlayfs mmap function ovl_mmap() was
added in v4.19 but file_user_inode() was not added until v6.8 and never
back-ported to stable kernels.  FMODE_BACKING that it depends on was added
in v6.5.  This issue has gone largely unnoticed, so back-porting before
v6.8 is probably not worth it, so put 6.8 as the stable kernel prerequisite
version, although in practice the next long term kernel is 6.12.

Closes: https://lore.kernel.org/linux-perf-users/aBCwoq7w8ohBRQCh@fremen.lan
Reported-by: Edd Barrett <edd@...unixzoo.co.uk>
Signed-off-by: Adrian Hunter <adrian.hunter@...el.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@...radead.org>
Acked-by: Amir Goldstein <amir73il@...il.com>
Cc: stable@...r.kernel.org # 6.8
---
 kernel/events/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 7541f6f..cd63ec8 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -9492,7 +9492,7 @@ static bool perf_addr_filter_match(struct perf_addr_filter *filter,
 	if (!filter->path.dentry)
 		return false;
 
-	if (d_inode(filter->path.dentry) != file_inode(file))
+	if (d_inode(filter->path.dentry) != file_user_inode(file))
 		return false;
 
 	if (filter->offset > offset + size)