bpftool: Fix vmlinux BTF leak in cgroup commands

bpftool cgroup show and tree call libbpf_find_kernel_btf() to
resolve attach_btf names, but never release the returned BTF object.

For cgroup tree, do_show_tree_fn() is called once for each cgroup
visited by nftw(). When more than one cgroup has attached programs,
each callback overwrites btf_vmlinux with a new object and loses the
previous allocation.

Load vmlinux BTF only once during a tree walk and release it when
cgroup show or tree completes. Reset btf_vmlinux_id at the same time
so batch mode starts with clean state.

Fixes: 596f5fb2ea2a ("bpftool: implement cgroup tree for BPF_LSM_CGROUP")
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Reviewed-by: Quentin Monnet <qmo@kernel.org>
Link: https://lore.kernel.org/r/24357C69B4405079+20260617090117.280222-1-chenyichong@uniontech.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/tools/bpf/bpftool/cgroup.c b/tools/bpf/bpftool/cgroup.c
index ec356deb27c9ecca85653433c4d4968c9e667e13..ce69d1e5468e362f0c9f6c2a086688a41ee9c43a 100644 (file)
--- a/tools/bpf/bpftool/cgroup.c
+++ b/tools/bpf/bpftool/cgroup.c
@@ -78,6 +78,13 @@ static unsigned int query_flags;
 static struct btf *btf_vmlinux;
 static __u32 btf_vmlinux_id;
 
+static void free_btf_vmlinux(void)
+{
+       btf__free(btf_vmlinux);
+       btf_vmlinux = NULL;
+       btf_vmlinux_id = 0;
+}
+
 static enum bpf_attach_type parse_attach_type(const char *str)
 {
        const char *attach_type_str;
@@ -388,6 +395,8 @@ static int do_show(int argc, char **argv)
        if (json_output)
                jsonw_end_array(json_wtr);
 
+       free_btf_vmlinux();
+
 exit_cgroup:
        close(cgroup_fd);
 exit:
@@ -437,7 +446,9 @@ static int do_show_tree_fn(const char *fpath, const struct stat *sb,
                printf("%s\n", fpath);
        }
 
-       btf_vmlinux = libbpf_find_kernel_btf();
+       if (!btf_vmlinux)
+               btf_vmlinux = libbpf_find_kernel_btf();
+
        for (i = 0; i < ARRAY_SIZE(cgroup_attach_types); i++)
                show_bpf_progs(cgroup_fd, cgroup_attach_types[i], ftw->level);
 
@@ -540,6 +551,7 @@ static int do_show_tree(int argc, char **argv)
        if (json_output)
                jsonw_end_array(json_wtr);
 
+       free_btf_vmlinux();
        free(cgroup_alloced);
 
        return ret;