Returning zero from a bpf program attached to a perf event already suppresses any data output. By clearing pending_kill, returning zero from a bpf program will effectively pretend the sample never happened for all userspace purposes. Signed-off-by: Kyle Huey <khuey@xxxxxxxxxxxx> --- kernel/events/core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 19fddfc27a4a..6cda05a4969d 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -10421,8 +10421,10 @@ static void bpf_overflow_handler(struct perf_event *event, rcu_read_unlock(); out: __this_cpu_dec(bpf_prog_active); - if (!ret) + if (!ret) { + event->pending_kill = 0; return; + } event->orig_overflow_handler(event, data, regs); } -- 2.34.1