Re: [Patch v5 10/18] perf/x86/intel: Allow LBR read helpers to operate on explicit stacks

[Mi, Dapeng]

On 10/29/2026 6:38 PM, Peter Zijlstra wrote:
> On Thu, Oct 29, 2026 at 12:39:06PM +0800, Dapeng Mi wrote:
>> diff --git a/arch/x86/events/intel/lbr.c b/arch/x86/events/intel/lbr.c
>> index ee724b28d90c..63f0504f9d2a 100644
>> --- a/arch/x86/events/intel/lbr.c
>> +++ b/arch/x86/events/intel/lbr.c
>> @@ -105,7 +105,10 @@
>>  
>>  #define ARCH_LBR_CTL_MASK			0x7f000e
>>  
>> -static void intel_pmu_lbr_filter(struct cpu_hw_events *cpuc);
>> +static void intel_pmu_lbr_filter(struct cpu_hw_events *cpuc,
>> +				 struct perf_branch_stack *lbr_stack,
>> +				 struct perf_branch_entry *lbr_entries,
>> +				 u64 *lbr_counters);
>>  
>>  static __always_inline bool is_lbr_call_stack_bit_set(u64 config)
>>  {
>> @@ -741,10 +744,12 @@ void intel_pmu_lbr_disable_all(void)
>>  	}
>>  }
>>  
>> -void intel_pmu_lbr_read_32(struct cpu_hw_events *cpuc)
>> +void intel_pmu_lbr_read_32(struct cpu_hw_events *cpuc,
>> +			   struct perf_branch_stack *lbr_stack,
>> +			   struct perf_branch_entry *lbr_entries)
>>  {
>>  	unsigned long mask = x86_pmu.lbr_nr - 1;
>> -	struct perf_branch_entry *br = cpuc->lbr_entries;
>> +	struct perf_branch_entry *br = lbr_entries;
>>  	u64 tos = intel_pmu_lbr_tos();
>>  	int i;
>>  
>> @@ -775,11 +780,13 @@ void intel_pmu_lbr_read_32(struct cpu_hw_events *cpuc)
>>   * is the same as the linear address, allowing us to merge the LIP and EIP
>>   * LBR formats.
>>   */
>> -void intel_pmu_lbr_read_64(struct cpu_hw_events *cpuc)
>> +void intel_pmu_lbr_read_64(struct cpu_hw_events *cpuc,
>> +			   struct perf_branch_stack *lbr_stack,
>> +			   struct perf_branch_entry *lbr_entries)
>>  {
>>  	bool need_info = false, call_stack = false;
>>  	unsigned long mask = x86_pmu.lbr_nr - 1;
>> -	struct perf_branch_entry *br = cpuc->lbr_entries;
>> +	struct perf_branch_entry *br = lbr_entries;
>>  	u64 tos = intel_pmu_lbr_tos();
>>  	int i;
>>  	int out = 0;
> This makes no sense; why do you keep passing lbr_entries around when we
> have lbr_stack.entries[] ?

Yeah, that's actually what I did at the beginning. But sashiko raised the
warning below. :(

"

Does this trigger a CONFIG_UBSAN_BOUNDS panic when intel_pmu_store_lbr()
is inlined?
The lbr_stack pointer points to a struct
perf_branch_stack embedded directly in struct cpu_hw_events. Because it
is an embedded value-type struct, the compiler considers its size to be
fixed (16 bytes), treating the trailing flexible array member entries[]
as having 0 elements.
Accessing lbr_stack->entries[i] where i >= 0 can trigger strict array
bounds violations under -fstrict-flex-arrays=3 and CONFIG_UBSAN_BOUNDS.

"