Skip to content

Perf improvement and misc fixes - #27

Merged
tzussman merged 5 commits into
mainfrom
stack-probe-and-audit
Oct 11, 2026
Merged

tzussman merged 5 commits into
mainfrom
stack-probe-and-audit

Conversation

@tzussman

Copy link
Copy Markdown
Owner

No description provided.

bpf_get_stack() zero-fills whatever part of the buffer the stack does
not reach, and the buffer is sized from kernel.perf_event_max_stack, so
raising that sysctl made every traced allocation pay for clearing the
whole buffer: with the limit at 4095 frames a kmalloc()/kfree() pair
cost 430 ns under tracing against 190 ns at the default of 127, with the
difference entirely in memset.

Capture into the first 127 frames of the buffer first and repeat the
capture with the whole buffer only when the stack filled it. At the
default limit nothing changes and the second capture never runs; at 4095
the pair is back to 192 ns, and only stacks deeper than 127 frames are
unwound twice.
The allocs map holds a million entries and an update that fails because
it is full was ignored, so a module with more outstanding allocations
than that had the excess silently untracked and their leaks missed.
Count the failures and print a warning after the report, as is done for
truncated stacks, and have every test check that nothing was dropped.
record_free() printed the size of the freed allocation, under -t, from
the map entry it had just deleted. Hash map entries are recycled through
the BPF allocator and can be handed to another CPU's update as soon as
they are deleted, so the printed size could be that of an unrelated
allocation. Copy it out first.
The text ranges stayed set after module_free, so until userspace had
read the report and detached, allocations from any module loaded into
the same addresses were attributed to the traced one. Clear the ranges
in the module_free handler; frees are still matched by address.
The percpu_alloc_percpu tracepoint only gained its bytes_alloc field,
which the handler reads, in 5.19, so -P fails to load on older kernels.
@tzussman
tzussman merged commit f8cff99 into main Oct 11, 2026
9 checks passed
@tzussman
tzussman deleted the stack-probe-and-audit branch October 11, 2026 22:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant