[PATCH bpf-next] bpftool: Skip cgroups removed during cgroup tree walk

[PATCH bpf-next] bpftool: Skip cgroups removed during cgroup tree walk

[Jonathan Bastari Thamrin via B4 Relay]

From: Jonathan Bastari Thamrin <thamrinjonathan@gmail.com>

When a cgroup is removed after being found by nftw(), open() or
cgroup_has_attached_progs() in do_show_tree_fn() returns ENOENT.
This is treated as a fatal error so the walk stops and the rest of
the tree isn't listed. This is common on systemd hosts as
transient scopes are created and removed all the time.

With "systemd-run --user --scope true" running in a loop, the walk
fails within a few hundred runs:

  Error: can't query bpf programs attached to /sys/fs/cgroup/user.slice/user-1000.slice/user@1000.service/app.slice/run-p126141-i75408.scope: No such file or directory

Treat ENOENT as the cgroup being gone and continue the walk. With
this patch, 2000 runs in a row complete without error.

Link: https://github.com/libbpf/bpftool/issues/159
Fixes: 2058b38371d0 ("bpftool: introduce cgroup tree command")
Signed-off-by: Jonathan Bastari Thamrin <thamrinjonathan@gmail.com>
---
The ENODEV originally reported in #159 was fixed by 98b303c9bf05
("bpftool: Query only cgroup-related attach types"). This fixes the
ENOENT race that still breaks cgroup tree on bpftool v7.6.0.
---
 tools/bpf/bpftool/cgroup.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/tools/bpf/bpftool/cgroup.c b/tools/bpf/bpftool/cgroup.c
index fee1a260f6d1..be1c9d5a3bd4 100644
--- a/tools/bpf/bpftool/cgroup.c
+++ b/tools/bpf/bpftool/cgroup.c
@@ -463,12 +463,19 @@ static int do_show_tree_fn(const char *fpath, const struct stat *sb,
 
 	cgroup_fd = open(fpath, O_RDONLY);
 	if (cgroup_fd < 0) {
+		/* cgroup may have been removed after nftw() found it */
+		if (errno == ENOENT)
+			return 0;
 		p_err("can't open cgroup %s: %s", fpath, strerror(errno));
 		return SHOW_TREE_FN_ERR;
 	}
 
 	has_attached_progs = cgroup_has_attached_progs(cgroup_fd);
 	if (has_attached_progs < 0) {
+		if (errno == ENOENT) {
+			close(cgroup_fd);
+			return 0;
+		}
 		p_err("can't query bpf programs attached to %s: %s",
 		      fpath, strerror(errno));
 		close(cgroup_fd);

---
base-commit: 0fb18ce8a2e9de830433923cf65838933d615359
change-id: 20261111-bpftool-cgroup-tree-enoent-162db54c9a9e

Best regards,
-- 
Jonathan Bastari Thamrin <thamrinjonathan@gmail.com>

Re: [PATCH bpf-next] bpftool: Skip cgroups removed during cgroup tree walk

[Quentin Monnet]

2026-11-11 12:17 UTC+0700 ~ Jonathan Bastari Thamrin via B4 Relay
<devnull+thamrinjonathan.gmail.com@kernel.org>
> From: Jonathan Bastari Thamrin <thamrinjonathan@gmail.com>
> 
> When a cgroup is removed after being found by nftw(), open() or
> cgroup_has_attached_progs() in do_show_tree_fn() returns ENOENT.
> This is treated as a fatal error so the walk stops and the rest of
> the tree isn't listed. This is common on systemd hosts as
> transient scopes are created and removed all the time.
> 
> With "systemd-run --user --scope true" running in a loop, the walk
> fails within a few hundred runs:
> 
>   Error: can't query bpf programs attached to /sys/fs/cgroup/user.slice/user-1000.slice/user@1000.service/app.slice/run-p126141-i75408.scope: No such file or directory
> 
> Treat ENOENT as the cgroup being gone and continue the walk. With
> this patch, 2000 runs in a row complete without error.
> 
> Link: https://github.com/libbpf/bpftool/issues/159
> Fixes: 2058b38371d0 ("bpftool: introduce cgroup tree command")
> Signed-off-by: Jonathan Bastari Thamrin <thamrinjonathan@gmail.com>
> ---
> The ENODEV originally reported in #159 was fixed by 98b303c9bf05
> ("bpftool: Query only cgroup-related attach types"). This fixes the
> ENOENT race that still breaks cgroup tree on bpftool v7.6.0.

Looks good to me, thank you for the fix.

Acked-by: Quentin Monnet <qmo@kernel.org>