perf/bpf: Allow a BPF program to suppress all sample side effects

Returning zero from a BPF program attached to a perf event already
suppresses any data output. Return early from __perf_event_overflow() in
this case so it will also suppress event_limit accounting, SIGTRAP
generation, and F_ASYNC signalling.

Signed-off-by: Kyle Huey <khuey@kylehuey.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Song Liu <song@kernel.org>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20240412015019.7060-7-khuey@kylehuey.com

diff --git a/kernel/events/core.c b/kernel/events/core.c
index c6a6936183d5b6a78c59d008a7f6bb5125f55066..2212670cbe9b8547a22e2bc8bc3677beb2f2013f 100644 (file)
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -9677,6 +9677,9 @@ static int __perf_event_overflow(struct perf_event *event,
 
        ret = __perf_event_account_interrupt(event, throttle);
 
+       if (event->prog && !bpf_overflow_handler(event, data, regs))
+               return ret;
+
        /*
         * XXX event_limit might not quite work as expected on inherited
         * events
@@ -9726,8 +9729,7 @@ static int __perf_event_overflow(struct perf_event *event,
                irq_work_queue(&event->pending_irq);
        }
 
-       if (!(event->prog && !bpf_overflow_handler(event, data, regs)))
-               READ_ONCE(event->overflow_handler)(event, data, regs);
+       READ_ONCE(event->overflow_handler)(event, data, regs);
 
        if (*perf_event_fasync(event) && event->pending_kill) {
                event->pending_wakeup = 1;