Re: [PATCH v3 2/2] tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] Severe memory leak of the btf_vmlinux object during cgroup tree traversal or repeated cgroup commands in batch mode.
--

commit f6cbf97292c743366f83c8ee625e792b14e79b4f
Author: Yichong Chen <chenyichong@uniontech.com>

tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands

struct_ops frees the global btf_vmlinux object. In batch mode, a later
struct_ops command can reuse stale state. This resets the BTF pointer
and cached map info state.

> diff --git a/tools/bpf/bpftool/struct_ops.c b/tools/bpf/bpftool/struct_ops.c
> index aa43dead249cb..4dba7c96e5f60 100644
> --- a/tools/bpf/bpftool/struct_ops.c
> +++ b/tools/bpf/bpftool/struct_ops.c
[ ... ]
> @@ -642,7 +651,7 @@ int do_struct_ops(int argc, char **argv)
>  
>  	err = cmd_select(cmds, argc, argv, do_help);
>  
> -	btf__free(btf_vmlinux);
> +	free_btf_vmlinux();
>  

[Severity: Medium]
This is a pre-existing issue, but while you are fixing the batch mode state
for struct_ops, could a similar btf_vmlinux memory leak be occurring in
cgroup commands?

Looking at tools/bpf/bpftool/cgroup.c:do_show():

	btf_vmlinux = libbpf_find_kernel_btf();

In batch mode, does every cgroup show command overwrite the global
btf_vmlinux pointer without freeing the previous BTF object?

Similarly, in tools/bpf/bpftool/cgroup.c:do_show_tree_fn():

	btf_vmlinux = libbpf_find_kernel_btf();

During a cgroup tree command, nftw() calls this function for every cgroup
directory. Does it load a new kernel BTF object each time and overwrite the
global pointer without freeing the previous one, creating a leak that scales
with the size of the cgroup hierarchy?

>  	return err;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260623072220.1421837-1-chenyichong@uniontech.com?part=2