[PATCH] tools/bpf/bpftool: Fix vmlinux BTF leak in cgroup commands

[PATCH] tools/bpf/bpftool: Fix vmlinux BTF leak in cgroup commands

[Yichong Chen]

bpftool cgroup show and tree call libbpf_find_kernel_btf() to
resolve attach_btf names, but never release the returned BTF object.

For cgroup tree, do_show_tree_fn() is called once for each cgroup
visited by nftw(). When more than one cgroup has attached programs,
each callback overwrites btf_vmlinux with a new object and loses the
previous allocation.

Load vmlinux BTF only once during a tree walk and release it when
cgroup show or tree completes. Reset btf_vmlinux_id at the same time
so batch mode starts with clean state.

Fixes: 596f5fb2ea2a ("bpftool: implement cgroup tree for BPF_LSM_CGROUP")
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
---
 tools/bpf/bpftool/cgroup.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/tools/bpf/bpftool/cgroup.c b/tools/bpf/bpftool/cgroup.c
index ec356deb27c9..ce69d1e5468e 100644
--- a/tools/bpf/bpftool/cgroup.c
+++ b/tools/bpf/bpftool/cgroup.c
@@ -78,6 +78,13 @@ static unsigned int query_flags;
 static struct btf *btf_vmlinux;
 static __u32 btf_vmlinux_id;
 
+static void free_btf_vmlinux(void)
+{
+	btf__free(btf_vmlinux);
+	btf_vmlinux = NULL;
+	btf_vmlinux_id = 0;
+}
+
 static enum bpf_attach_type parse_attach_type(const char *str)
 {
 	const char *attach_type_str;
@@ -388,6 +395,8 @@ static int do_show(int argc, char **argv)
 	if (json_output)
 		jsonw_end_array(json_wtr);
 
+	free_btf_vmlinux();
+
 exit_cgroup:
 	close(cgroup_fd);
 exit:
@@ -437,7 +446,9 @@ static int do_show_tree_fn(const char *fpath, const struct stat *sb,
 		printf("%s\n", fpath);
 	}
 
-	btf_vmlinux = libbpf_find_kernel_btf();
+	if (!btf_vmlinux)
+		btf_vmlinux = libbpf_find_kernel_btf();
+
 	for (i = 0; i < ARRAY_SIZE(cgroup_attach_types); i++)
 		show_bpf_progs(cgroup_fd, cgroup_attach_types[i], ftw->level);
 
@@ -540,6 +551,7 @@ static int do_show_tree(int argc, char **argv)
 	if (json_output)
 		jsonw_end_array(json_wtr);
 
+	free_btf_vmlinux();
 	free(cgroup_alloced);
 
 	return ret;
-- 
2.51.0

Re: [PATCH] tools/bpf/bpftool: Fix vmlinux BTF leak in cgroup commands

[Quentin Monnet]

2026-06-17 17:01 UTC+0800 ~ Yichong Chen <chenyichong@uniontech.com>
> bpftool cgroup show and tree call libbpf_find_kernel_btf() to
> resolve attach_btf names, but never release the returned BTF object.
> 
> For cgroup tree, do_show_tree_fn() is called once for each cgroup
> visited by nftw(). When more than one cgroup has attached programs,
> each callback overwrites btf_vmlinux with a new object and loses the
> previous allocation.
> 
> Load vmlinux BTF only once during a tree walk and release it when
> cgroup show or tree completes. Reset btf_vmlinux_id at the same time
> so batch mode starts with clean state.
> 
> Fixes: 596f5fb2ea2a ("bpftool: implement cgroup tree for BPF_LSM_CGROUP")
> Signed-off-by: Yichong Chen <chenyichong@uniontech.com>


Reviewed-by: Quentin Monnet <qmo@kernel.org>

Thank you.

It seems that Sashiko is right regarding the occurrences in struct_ops.c
and map.c, would you mind following up with the related fixes, please?

Thanks,
Quentin

Re: [PATCH] tools/bpf/bpftool: Fix vmlinux BTF leak in cgroup commands

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Wed, 17 Jun 2026 17:01:17 +0800 you wrote:
> bpftool cgroup show and tree call libbpf_find_kernel_btf() to
> resolve attach_btf names, but never release the returned BTF object.
> 
> For cgroup tree, do_show_tree_fn() is called once for each cgroup
> visited by nftw(). When more than one cgroup has attached programs,
> each callback overwrites btf_vmlinux with a new object and loses the
> previous allocation.
> 
> [...]

Here is the summary with links:
  - tools/bpf/bpftool: Fix vmlinux BTF leak in cgroup commands
    https://git.kernel.org/bpf/bpf/c/bda6a7308ef8

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html