Looking up a prog or map by name walks the whole id space. There is a
window between bpf_prog_get_next_id()/bpf_map_get_next_id() and getting
an fd for that id in which an unrelated object can be freed, and the
lookup then fails with ENOENT and aborts the whole command.

Skip such ids and keep walking, the same way do_show() already does.

Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
 tools/bpf/bpftool/common.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c
index 8bfcff9e2f63..ef366ccc9650 100644
--- a/tools/bpf/bpftool/common.c
+++ b/tools/bpf/bpftool/common.c
@@ -832,6 +832,8 @@ static int prog_fd_by_nametag(void *nametag, int **fds, bool tag)
 
 		fd = bpf_prog_get_fd_by_id(id);
 		if (fd < 0) {
+			if (errno == ENOENT)
+				continue;
 			p_err("can't get prog by id (%u): %s",
 			      id, strerror(errno));
 			goto err_close_fds;
@@ -996,6 +998,8 @@ static int map_fd_by_name(char *name, int **fds,
 		opts_ro.open_flags = BPF_F_RDONLY;
 		fd = bpf_map_get_fd_by_id_opts(id, &opts_ro);
 		if (fd < 0) {
+			if (errno == ENOENT)
+				continue;
 			p_err("can't get map by id (%u): %s",
 			      id, strerror(errno));
 			goto err_close_fds;
-- 
2.43.0

> commit 084a91fc9c087ee9f5a2163da8368590cad6f121
> Author: Jiayuan Chen <jiayuan.chen@linux.dev>
>
>     bpftool: Skip prog/map that disappears while looking it up by name
>
>     Looking up a prog or map by name walks the whole id space. There is a
>     window between bpf_prog_get_next_id()/bpf_map_get_next_id() and getting
>     an fd for that id in which an unrelated object can be freed, and the
>     lookup then fails with ENOENT and aborts the whole command.
>
>     Skip such ids and keep walking, the same way do_show() already does.
>
>     Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>

This looks like a bug fix for the prog/map lookup functions. Should this
include:

  Fixes: a479b8ce4ed1 ("tools/bpftool: Move map/prog parsing logic into common")


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/29725108152

On 7/20/26 4:02 PM, bot+bpf-ci@kernel.org wrote:
>> commit 084a91fc9c087ee9f5a2163da8368590cad6f121
>> Author: Jiayuan Chen <jiayuan.chen@linux.dev>
>>
>>      bpftool: Skip prog/map that disappears while looking it up by name
>>
>>      Looking up a prog or map by name walks the whole id space. There is a
>>      window between bpf_prog_get_next_id()/bpf_map_get_next_id() and getting
>>      an fd for that id in which an unrelated object can be freed, and the
>>      lookup then fails with ENOENT and aborts the whole command.
>>
>>      Skip such ids and keep walking, the same way do_show() already does.
>>
>>      Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
> This looks like a bug fix for the prog/map lookup functions. Should this
> include:
>
>    Fixes: a479b8ce4ed1 ("tools/bpftool: Move map/prog parsing logic into common")


It's not worth backporting it.

People can always upgrade bpftool to latest version.