[PATCH v3 1/2] tools/bpf/bpftool: Reset vmlinux BTF after map commands

[PATCH v3 1/2] tools/bpf/bpftool: Reset vmlinux BTF after map commands

[Yichong Chen]

get_map_kv_btf() caches the vmlinux BTF object when a map uses
btf_vmlinux_value_type_id. map dump released that object when the
command completed, but left the global pointer stale.

The same cached object can also be returned to print_key_value(), which
freed it directly. That leaves btf_vmlinux dangling before the command
cleanup path runs.

Use free_map_kv_btf() for per-entry cleanup, and reset the cached
btf_vmlinux pointer when the map command releases the object. This keeps
batch mode from reusing a freed BTF object.

Fixes: 4e1ea33292ff ("bpftool: Support dumping a map with btf_vmlinux_value_type_id")
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
---
 tools/bpf/bpftool/map.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
index 7ebf7dbcfba4..a265ad3afbb0 100644
--- a/tools/bpf/bpftool/map.c
+++ b/tools/bpf/bpftool/map.c
@@ -790,6 +790,12 @@ static int maps_have_btf(int *fds, int nb_fds)
 
 static struct btf *btf_vmlinux;
 
+static void free_btf_vmlinux(void)
+{
+	btf__free(btf_vmlinux);
+	btf_vmlinux = NULL;
+}
+
 static int get_map_kv_btf(const struct bpf_map_info *info, struct btf **btf)
 {
 	int err = 0;
@@ -958,7 +964,7 @@ static int do_dump(int argc, char **argv)
 		close(fds[i]);
 exit_free:
 	free(fds);
-	btf__free(btf_vmlinux);
+	free_btf_vmlinux();
 	return err;
 }
 
@@ -1049,7 +1055,7 @@ static void print_key_value(struct bpf_map_info *info, void *key,
 		btf_wtr = get_btf_writer();
 		if (!btf_wtr) {
 			p_info("failed to create json writer for btf. falling back to plain output");
-			btf__free(btf);
+			free_map_kv_btf(btf);
 			btf = NULL;
 			print_entry_plain(info, key, value);
 		} else {
@@ -1065,7 +1071,7 @@ static void print_key_value(struct bpf_map_info *info, void *key,
 	} else {
 		print_entry_plain(info, key, value);
 	}
-	btf__free(btf);
+	free_map_kv_btf(btf);
 }
 
 static int do_lookup(int argc, char **argv)
-- 
2.51.0

Re: [PATCH v3 1/2] tools/bpf/bpftool: Reset vmlinux BTF after map commands

[Emil Tsalapatis]

On Tue Jun 23, 2026 at 3:22 AM EDT, Yichong Chen wrote:
> get_map_kv_btf() caches the vmlinux BTF object when a map uses
> btf_vmlinux_value_type_id. map dump released that object when the
> command completed, but left the global pointer stale.
>
> The same cached object can also be returned to print_key_value(), which
> freed it directly. That leaves btf_vmlinux dangling before the command
> cleanup path runs.
>
> Use free_map_kv_btf() for per-entry cleanup, and reset the cached
> btf_vmlinux pointer when the map command releases the object. This keeps
> batch mode from reusing a freed BTF object.
>
> Fixes: 4e1ea33292ff ("bpftool: Support dumping a map with btf_vmlinux_value_type_id")
> Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
> ---
>  tools/bpf/bpftool/map.c | 12 +++++++++---

Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>

>  1 file changed, 9 insertions(+), 3 deletions(-)
>
> diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c
> index 7ebf7dbcfba4..a265ad3afbb0 100644
> --- a/tools/bpf/bpftool/map.c
> +++ b/tools/bpf/bpftool/map.c
> @@ -790,6 +790,12 @@ static int maps_have_btf(int *fds, int nb_fds)
>  
>  static struct btf *btf_vmlinux;
>  
> +static void free_btf_vmlinux(void)
> +{
> +	btf__free(btf_vmlinux);
> +	btf_vmlinux = NULL;
> +}
> +
>  static int get_map_kv_btf(const struct bpf_map_info *info, struct btf **btf)
>  {
>  	int err = 0;
> @@ -958,7 +964,7 @@ static int do_dump(int argc, char **argv)
>  		close(fds[i]);
>  exit_free:
>  	free(fds);
> -	btf__free(btf_vmlinux);
> +	free_btf_vmlinux();
>  	return err;
>  }
>  
> @@ -1049,7 +1055,7 @@ static void print_key_value(struct bpf_map_info *info, void *key,
>  		btf_wtr = get_btf_writer();
>  		if (!btf_wtr) {
>  			p_info("failed to create json writer for btf. falling back to plain output");
> -			btf__free(btf);
> +			free_map_kv_btf(btf);
>  			btf = NULL;
>  			print_entry_plain(info, key, value);
>  		} else {
> @@ -1065,7 +1071,7 @@ static void print_key_value(struct bpf_map_info *info, void *key,
>  	} else {
>  		print_entry_plain(info, key, value);
>  	}
> -	btf__free(btf);
> +	free_map_kv_btf(btf);
>  }
>  
>  static int do_lookup(int argc, char **argv)

[PATCH v3 2/2] tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands

[Yichong Chen]

struct_ops frees the global btf_vmlinux object.

In batch mode, a later struct_ops command can reuse stale state.

Reset the BTF pointer and cached map info state.

Fixes: 65c93628599d ("bpftool: Add struct_ops support")
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
---
 tools/bpf/bpftool/struct_ops.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/tools/bpf/bpftool/struct_ops.c b/tools/bpf/bpftool/struct_ops.c
index aa43dead249c..4dba7c96e5f6 100644
--- a/tools/bpf/bpftool/struct_ops.c
+++ b/tools/bpf/bpftool/struct_ops.c
@@ -21,6 +21,15 @@ static __u32 map_info_alloc_len;
 static struct btf *btf_vmlinux;
 static __s32 map_info_type_id;
 
+static void free_btf_vmlinux(void)
+{
+	btf__free(btf_vmlinux);
+	btf_vmlinux = NULL;
+	map_info_type = NULL;
+	map_info_alloc_len = 0;
+	map_info_type_id = 0;
+}
+
 struct res {
 	unsigned int nr_maps;
 	unsigned int nr_errs;
@@ -642,7 +651,7 @@ int do_struct_ops(int argc, char **argv)
 
 	err = cmd_select(cmds, argc, argv, do_help);
 
-	btf__free(btf_vmlinux);
+	free_btf_vmlinux();
 
 	return err;
 }
-- 
2.51.0

Re: [PATCH v3 2/2] tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands

[Emil Tsalapatis]

On Tue Jun 23, 2026 at 3:22 AM EDT, Yichong Chen wrote:
> struct_ops frees the global btf_vmlinux object.
>
> In batch mode, a later struct_ops command can reuse stale state.
>
> Reset the BTF pointer and cached map info state.
>
> Fixes: 65c93628599d ("bpftool: Add struct_ops support")
> Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
> ---
>  tools/bpf/bpftool/struct_ops.c | 11 ++++++++++-
>  1 file changed, 10 insertions(+), 1 deletion(-)
>
> diff --git a/tools/bpf/bpftool/struct_ops.c b/tools/bpf/bpftool/struct_ops.c
> index aa43dead249c..4dba7c96e5f6 100644
> --- a/tools/bpf/bpftool/struct_ops.c
> +++ b/tools/bpf/bpftool/struct_ops.c
> @@ -21,6 +21,15 @@ static __u32 map_info_alloc_len;
>  static struct btf *btf_vmlinux;
>  static __s32 map_info_type_id;
>  
> +static void free_btf_vmlinux(void)
> +{
> +	btf__free(btf_vmlinux);
> +	btf_vmlinux = NULL;
> +	map_info_type = NULL;
> +	map_info_alloc_len = 0;
> +	map_info_type_id = 0;
> +}

Nit but I don't think we need this to be a separate helper. We use it
once, and it has the exact same name and type as the one in the previous
patch.

pw-bot: cr

> +
>  struct res {
>  	unsigned int nr_maps;
>  	unsigned int nr_errs;
> @@ -642,7 +651,7 @@ int do_struct_ops(int argc, char **argv)
>  
>  	err = cmd_select(cmds, argc, argv, do_help);
>  
> -	btf__free(btf_vmlinux);
> +	free_btf_vmlinux();
>  
>  	return err;
>  }