Returning zero from a bpf program attached to a perf event already suppresses any data output. Return early from __perf_event_overflow() in this case so it will also suppress event_limit accounting, SIGTRAP generation, and F_ASYNC signalling. Signed-off-by: Kyle Huey <khuey@xxxxxxxxxxxx> --- kernel/events/core.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 54f6372d2634..d6093fe893c8 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -9541,6 +9541,11 @@ static int __perf_event_overflow(struct perf_event *event, ret = __perf_event_account_interrupt(event, throttle); +#ifdef CONFIG_BPF_SYSCALL + if (event->prog && !bpf_overflow_handler(event, data, regs)) + return ret; +#endif + /* * XXX event_limit might not quite work as expected on inherited * events @@ -9590,10 +9595,7 @@ static int __perf_event_overflow(struct perf_event *event, irq_work_queue(&event->pending_irq); } -#ifdef CONFIG_BPF_SYSCALL - if (!(event->prog && !bpf_overflow_handler(event, data, regs))) -#endif - READ_ONCE(event->overflow_handler)(event, data, regs); + READ_ONCE(event->overflow_handler)(event, data, regs); if (*perf_event_fasync(event) && event->pending_kill) { event->pending_wakeup = 1; -- 2.34.1