Re: [PATCH v6 01/11] perf bpf-filter: Fix bpf_link leak by using PERF_EVENT_IOC_SET_BPF

[Namhyung Kim]

On Thu, Oct 22, 2026 at 01:29:53PM -0700, Ian Rogers wrote:
> In perf_bpf_filter__prepare(), the unpinned filter path attaches
> skel->progs.perf_sample_filter to each FD(evsel, x, y) using
> bpf_program__attach_perf_event_opts() and ignores the returned
> struct bpf_link *, leaking the allocated struct bpf_link_perf and its
> BPF_PERF_EVENT link fd.
> 
> Furthermore, bpf_program__attach_perf_event_opts() is designed for
> callers that transfer ownership of the perf_event fd to the returned
> bpf_link: when bpf_link__destroy() is called, bpf_link_perf_detach()
> unconditionally disables and closes perf_link->perf_event_fd. Because
> evsel->core.fd owns FD(evsel, x, y) and closes them in evlist__close(),
> destroying the returned bpf_link would double-close the perf_event file
> descriptors.
> 
> Fix this by attaching the program directly with
> ioctl(FD(evsel, x, y), PERF_EVENT_IOC_SET_BPF, fd), matching the pinned
> filter path right above it in perf_bpf_filter__prepare(). In the
> kernel, PERF_EVENT_IOC_SET_BPF takes a reference on the BPF program and
> _free_event() -> perf_event_free_bpf_prog() automatically detaches and
> releases it when the perf_event fd is closed. This also avoids enabling
> the event prematurely, allowing pe_opts (.dont_enable = true) and the
> LIBBPF_CURRENT_VERSION_GEQ(1, 7) guard to be dropped.
> 
> Before (built with EXTRA_CFLAGS="-fsanitize=address"):
>   # perf record -e cycles --filter 'period > 1000' -- true
>   [ perf record: Woken up 1 times to write data ]
>   [ perf record: Captured and wrote 0.024 MB perf.data ]
> 
>   =================================================================
>   ==51328==ERROR: LeakSanitizer: detected memory leaks
> 
>   Direct leak of 1568 byte(s) in 28 object(s) allocated from:
>       #0 0x7ffbe76ef24f in calloc (/lib64/libasan.so.8+0xef24f)
>       #1 0x625df7 in bpf_program__attach_perf_event_opts (tools/perf/perf+0x625df7)
>       #2 0xbeddc0 in perf_bpf_filter__prepare util/bpf-filter.c:507
>       #3 0x8f3def in evlist__apply_filters util/evlist.c:1421
>       #4 0x44bbcf in record__open tools/perf/builtin-record.c:1469
>       #5 0x453f9e in __cmd_record tools/perf/builtin-record.c:2594
>       #6 0x45dadb in cmd_record tools/perf/builtin-record.c:4427
>       #7 0x5df56b in run_builtin tools/perf/perf.c:383
>       #8 0x5dfa0e in handle_internal_command tools/perf/perf.c:436
>       #9 0x5dfddc in run_argv tools/perf/perf.c:480
>       #10 0x5e0333 in main tools/perf/perf.c:581
> 
>   SUMMARY: AddressSanitizer: 1568 byte(s) leaked in 28 allocation(s).
> 
> After (built with EXTRA_CFLAGS="-fsanitize=address"):
>   # perf record -e cycles --filter 'period > 1000' -- true
>   [ perf record: Woken up 1 times to write data ]
>   [ perf record: Captured and wrote 0.024 MB perf.data ]
> 
> Reported-by: Namhyung Kim <namhyung@xxxxxxxxxx>
> Closes: https://lore.kernel.org/linux-perf-users/20261020053226.55936-1-namhyung@xxxxxxxxxx/
> Fixes: 56ec9457a4a2 ("perf bpf filter: Implement event sample filtering")
> Signed-off-by: Ian Rogers <irogers@xxxxxxxxxx>

Tested-by: Namhyung Kim <namhyung@xxxxxxxxxx>

Thanks,
Namhyung

> ---
>  tools/perf/util/bpf-filter.c | 18 +++++-------------
>  1 file changed, 5 insertions(+), 13 deletions(-)
> 
> diff --git a/tools/perf/util/bpf-filter.c b/tools/perf/util/bpf-filter.c
> index 72e83ac1d6a4..506414e5c407 100644
> --- a/tools/perf/util/bpf-filter.c
> +++ b/tools/perf/util/bpf-filter.c
> @@ -40,6 +40,7 @@
>   * The 'dropped' map is to keep how many samples it dropped by the filter and
>   * it will be reported as lost samples.
>   */
> +#include <errno.h>
>  #include <stdlib.h>
>  #include <fcntl.h>
>  #include <sys/ioctl.h>
> @@ -423,16 +424,8 @@ int perf_bpf_filter__prepare(struct evsel *evsel, struct target *target)
>  {
>  	int i, x, y, fd, ret;
>  	struct sample_filter_bpf *skel = NULL;
> -	struct bpf_program *prog;
> -	struct bpf_link *link;
>  	struct perf_bpf_filter_entry *entry;
>  	bool needs_idx_hash = !target__has_cpu(target);
> -#if LIBBPF_CURRENT_VERSION_GEQ(1, 7)
> -	DECLARE_LIBBPF_OPTS(bpf_perf_event_opts, pe_opts,
> -			    .dont_enable = true);
> -#else
> -	DECLARE_LIBBPF_OPTS(bpf_perf_event_opts, pe_opts);
> -#endif
>  
>  	entry = calloc(MAX_FILTERS, sizeof(*entry));
>  	if (entry == NULL)
> @@ -501,14 +494,13 @@ int perf_bpf_filter__prepare(struct evsel *evsel, struct target *target)
>  		goto err;
>  	}
>  
> -	prog = skel->progs.perf_sample_filter;
> +	fd = bpf_program__fd(skel->progs.perf_sample_filter);
>  	for (x = 0; x < xyarray__max_x(evsel->core.fd); x++) {
>  		for (y = 0; y < xyarray__max_y(evsel->core.fd); y++) {
> -			link = bpf_program__attach_perf_event_opts(prog, FD(evsel, x, y),
> -								   &pe_opts);
> -			if (IS_ERR(link)) {
> +			ret = ioctl(FD(evsel, x, y), PERF_EVENT_IOC_SET_BPF, fd);
> +			if (ret < 0) {
> +				ret = -errno;
>  				pr_err("Failed to attach perf sample-filter program\n");
> -				ret = PTR_ERR(link);
>  				goto err;
>  			}
>  		}
> -- 
> 2.56.0.307.g5fe7bd680c-goog
>