bpf_cgroup_ancestor(9)

💖 bpf_cgroup_ancestor(9) — the Kernel API Manual page, but make it make sense ✨

okay so bestie, welcome to bpf_cgroup_ancestor(9), straight out of the Kernel API Manual 💅 this little icon does a lookup on an entry in a cgroup's ancestor array — yes, that's the whole vibe. and like, super important: a cgroup that this kfunc hands back to you, if you're not gonna immediately store it in a map, must be released by calling bpf_cgroup_release(). no cap, don't just ghost it 😭

🌸 SYNOPSIS 🌸

__bpf_kfunc struct cgroup * bpf_cgroup_ancestor (struct cgroup *cgrp ,
int level );

look at her. iconic signature. 🎀

🦋 ARGUMENTS 🦋

• cgrp — the cgroup we're performing a lookup on. like, the one you're being nosy about 👀
• level — the level of ancestor to look up. which generation of the family tree you want, bestie 🌈

⭐ SEE ALSO ⭐

everything in the group chat, fr fr — Kernel file ./kernel/bpf/helpers.c and all her besties:

• bpf_obj_new(9)
• bpf_percpu_obj_new(9)
• bpf_obj_drop(9)
• bpf_percpu_obj_drop(9)
• bpf_refcount_acquire(9)
• bpf_list_push_front(9)
• bpf_list_push_back(9)
• bpf_rbtree_add(9)
• bpf_task_acquire(9)
• bpf_task_release(9)
• bpf_cgroup_acquire(9)
• bpf_cgroup_release(9)
• bpf_cgroup_from_id(9)
• bpf_task_under_cgroup(9)
• bpf_task_get_cgroup1(9)
• bpf_task_from_pid(9)
• bpf_task_from_vpid(9)
• bpf_dynptr_slice(9)
• bpf_dynptr_slice_rdwr(9)
• bpf_dynptr_copy(9)
• bpf_dynptr_memset(9)
• bpf_iter_bits_new(9)
• bpf_iter_bits_next(9)
• bpf_iter_bits_destroy(9)
• bpf_copy_from_user_str(9)
• bpf_copy_from_user_task_str(9)
• bpf_strcmp(9)
• bpf_strcasecmp(9)
• bpf_strnchr(9)
• bpf_strchr(9)
• bpf_strchrnul(9)
• bpf_strrchr(9)
• bpf_strnlen(9)
• bpf_strlen(9)
• bpf_strspn(9)
• bpf_strcspn(9)
• bpf_strstr(9)
• bpf_strcasestr(9)
• bpf_strnstr(9)
• bpf_strncasestr(9)
• bpf_lookup_user_key(9)
• bpf_lookup_system_key(9)
• bpf_key_put(9)
• bpf_verify_pkcs7_signature(9)
• bpf_task_work_schedule_signal(9)
• bpf_task_work_schedule_resume(9)
• bpf_timer_cancel_async(9)

like, the whole friend group showed up 🫶

⚠️ reminder one more time because I care about you: if you get a cgroup back from this kfunc and you do not store it in a map, you must call bpf_cgroup_release() on it. memory leaks are not the vibe, bestie 💀

kisses from the kernel 💜 this page lives in ./kernel/bpf, drops in October 2026, and yeah — it's bpf_cgroup_ancestor(9), that's her name, don't wear it out 💅✨