Re: [PATCH] tools/bpf/bpftool: Fix vmlinux BTF leak in cgroup commands

[Quentin Monnet]

2026-06-17 17:01 UTC+0800 ~ Yichong Chen <chenyichong@xxxxxxxxxxxxx>
> bpftool cgroup show and tree call libbpf_find_kernel_btf() to
> resolve attach_btf names, but never release the returned BTF object.
> 
> For cgroup tree, do_show_tree_fn() is called once for each cgroup
> visited by nftw(). When more than one cgroup has attached programs,
> each callback overwrites btf_vmlinux with a new object and loses the
> previous allocation.
> 
> Load vmlinux BTF only once during a tree walk and release it when
> cgroup show or tree completes. Reset btf_vmlinux_id at the same time
> so batch mode starts with clean state.
> 
> Fixes: 596f5fb2ea2a ("bpftool: implement cgroup tree for BPF_LSM_CGROUP")
> Signed-off-by: Yichong Chen <chenyichong@xxxxxxxxxxxxx>


Reviewed-by: Quentin Monnet <qmo@xxxxxxxxxx>

Thank you.

It seems that Sashiko is right regarding the occurrences in struct_ops.c
and map.c, would you mind following up with the related fixes, please?

Thanks,
Quentin