Re: [PATCH v2 2/2] tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] Unconditional memory leak of the global `btf_vmlinux` object during cgroup tree traversal and batch mode.
--

commit bd1d63c4728bc77ece052cc69d67e204a7e59411
Author: Yichong Chen <chenyichong@uniontech.com>

tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands

struct_ops frees the global btf_vmlinux object. In batch mode, a later
struct_ops command can reuse stale state. This patch resets the BTF
pointer and cached map info state.

> diff --git a/tools/bpf/bpftool/struct_ops.c b/tools/bpf/bpftool/struct_ops.c
> index aa43dead249cb..4dba7c96e5f60 100644
> --- a/tools/bpf/bpftool/struct_ops.c
> +++ b/tools/bpf/bpftool/struct_ops.c
> @@ -21,6 +21,15 @@ static __u32 map_info_alloc_len;
>  static struct btf *btf_vmlinux;
>  static __s32 map_info_type_id;
>  
> +static void free_btf_vmlinux(void)
> +{
> +	btf__free(btf_vmlinux);
> +	btf_vmlinux = NULL;
> +	map_info_type = NULL;
> +	map_info_alloc_len = 0;
> +	map_info_type_id = 0;
> +}
> +

[Severity: Medium]
This isn't a bug introduced by this patch, but since we are addressing BTF
memory management and stale state in batch mode, could we also look at
similar leaks in cgroup.c?

In tools/bpf/bpftool/cgroup.c, libbpf_find_kernel_btf() is called
unconditionally to initialize the btf_vmlinux pointer in both do_show() and
do_show_tree_fn(), without any subsequent cleanup.

For example, in the tree traversal:

tools/bpf/bpftool/cgroup.c:do_show_tree_fn() {
    ...
	btf_vmlinux = libbpf_find_kernel_btf();
	for (i = 0; i < ARRAY_SIZE(cgroup_attach_types); i++)
		show_bpf_progs(cgroup_fd, cgroup_attach_types[i], ftw->level);
    ...
}

Because do_show_tree_fn() is called by nftw() for every directory in the
cgroup tree, it repeatedly allocates a new BTF object and overwrites the
pointer without freeing the previous instance.

Could this cause an O(N) memory leak scaling with the number of cgroups,
potentially leading to OOM crashes of the bpftool process during traversal
or when running cgroup commands in batch mode?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260622031255.1160657-1-chenyichong@uniontech.com?part=2