src/internal/runtime/cgroup/cgroup.go - go - Git at Google

 // Copyright 2025 The Go Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.

 package cgroup

 import (
 	"internal/bytealg"
 	"internal/strconv"
 )

 var (
 	ErrNoCgroup error = stringError("not in a cgroup")

 	errMalformedFile error = stringError("malformed file")
 )

 const _PATH_MAX = 4096

 const (
 	// Required amount of scratch space for CPULimit.
 	//
 	// TODO(prattmic): This is shockingly large (~70KiB) due to the (very
 	// unlikely) combination of extremely long paths consisting mostly
 	// escaped characters. The scratch buffer ends up in .bss in package
 	// runtime, so it doesn't contribute to binary size and generally won't
 	// be faulted in, but it would still be nice to shrink this. A more
 	// complex parser that did not need to keep entire lines in memory
 	// could get away with much less. Alternatively, we could do a one-off
 	// mmap allocation for this buffer, which is only mapped larger if we
 	// actually need the extra space.
 	ScratchSize = PathSize + ParseSize

 	// Required space to store a path of the cgroup in the filesystem.
 	PathSize = _PATH_MAX

 	// /proc/self/mountinfo path escape sequences are 4 characters long, so
 	// a path consisting entirely of escaped characters could be 4 times
 	// larger.
 	escapedPathMax = 4 * _PATH_MAX

 	// Required space to parse /proc/self/mountinfo and /proc/self/cgroup.
 	// See findCPUMount and findCPURelativePath.
 	ParseSize = 4 * escapedPathMax
 )

 // Version indicates the cgroup version.
 type Version int

 const (
 	VersionUnknown Version = iota
 	V1
 	V2
 )

 func parseV1Number(buf []byte) (int64, error) {
 	// Ignore trailing newline.
 	i := bytealg.IndexByte(buf, '\n')
 	if i < 0 {
 		return 0, errMalformedFile
 	}
 	buf = buf[:i]

 	val, err := strconv.ParseInt(string(buf), 10, 64)
 	if err != nil {
 		return 0, errMalformedFile
 	}

 	return val, nil
 }

 func parseV2Limit(buf []byte) (float64, bool, error) {
 	i := bytealg.IndexByte(buf, ' ')
 	if i < 0 {
 		return 0, false, errMalformedFile
 	}

 	quotaStr := buf[:i]
 	if bytealg.Compare(quotaStr, []byte("max")) == 0 {
 		// No limit.
 		return 0, false, nil
 	}

 	periodStr := buf[i+1:]
 	// Ignore trailing newline, if any.
 	i = bytealg.IndexByte(periodStr, '\n')
 	if i < 0 {
 		return 0, false, errMalformedFile
 	}
 	periodStr = periodStr[:i]

 	quota, err := strconv.ParseInt(string(quotaStr), 10, 64)
 	if err != nil {
 		return 0, false, errMalformedFile
 	}

 	period, err := strconv.ParseInt(string(periodStr), 10, 64)
 	if err != nil {
 		return 0, false, errMalformedFile
 	}

 	return float64(quota) / float64(period), true, nil
 }

 // Finds the path of the current process's CPU cgroup and writes it to out.
 //
 // fd is a file descriptor for /proc/self/cgroup.
 // Returns the number of bytes written and the cgroup version (1 or 2).
 func parseCPUCgroup(fd int, read func(fd int, b []byte) (int, uintptr), out []byte, scratch []byte) (int, Version, error) {
 	// The format of each line is
 	//
 	//   hierarchy-ID:controller-list:cgroup-path
 	//
 	// controller-list is comma-separated.
 	//
 	// cgroup v2 has hierarchy-ID 0. If a v1 hierarchy contains "cpu", that
 	// is the CPU controller. Otherwise the v2 hierarchy (if any) is the
 	// CPU controller. It is not possible to mount the same controller
 	// simultaneously under both the v1 and the v2 hierarchies.
 	//
 	// See man 7 cgroups for more details.
 	//
 	// hierarchy-ID and controller-list have relatively small maximum
 	// sizes, and the path can be up to _PATH_MAX, so we need a bit more
 	// than 1 _PATH_MAX of scratch space.

 	l := newLineReader(fd, scratch, read)

 	// Bytes written to out.
 	n := 0

 	for {
 		err := l.next()
 		if err == errIncompleteLine {
 			// Don't allow incomplete lines. While in theory the
 			// incomplete line may be for a controller we don't
 			// care about, in practice all lines should be of
 			// similar length, so we should just have a buffer big
 			// enough for any.
 			return 0, 0, err
 		} else if err == errEOF {
 			break
 		} else if err != nil {
 			return 0, 0, err
 		}

 		line := l.line()

 		// The format of each line is
 		//
 		//   hierarchy-ID:controller-list:cgroup-path
 		//
 		// controller-list is comma-separated.
 		// See man 7 cgroups for more details.
 		i := bytealg.IndexByte(line, ':')
 		if i < 0 {
 			return 0, 0, errMalformedFile
 		}

 		hierarchy := line[:i]
 		line = line[i+1:]

 		i = bytealg.IndexByte(line, ':')
 		if i < 0 {
 			return 0, 0, errMalformedFile
 		}

 		controllers := line[:i]
 		line = line[i+1:]

 		path := line
 		if len(path) == 0 || path[0] != '/' {
 			// We rely on this when composing the full path.
 			return 0, 0, errMalformedFile
 		}
 		if len(path) > len(out) {
 			// Should not be possible. If we really get a very long cgroup path,
 			// read /proc/self/cgroup will fail with ENAMETOOLONG.
 			return 0, 0, errPathTooLong
 		}

 		if string(hierarchy) == "0" {
 			// v2 hierarchy.
 			n = copy(out, path)
 			// Keep searching, we might find a v1 hierarchy with a
 			// CPU controller, which takes precedence.
 		} else {
 			// v1 hierarchy
 			if containsCPU(controllers) {
 				// Found a v1 CPU controller. This must be the
 				// only one, so we're done.
 				return copy(out, path), V1, nil
 			}
 		}
 	}

 	if n == 0 {
 		// Found nothing.
 		return 0, 0, ErrNoCgroup
 	}

 	// Must be v2, v1 returns above.
 	return n, V2, nil
 }

 // Returns true if comma-separated list b contains "cpu".
 func containsCPU(b []byte) bool {
 	for len(b) > 0 {
 		i := bytealg.IndexByte(b, ',')
 		if i < 0 {
 			// Neither cmd/compile nor gccgo allocates for these string conversions.
 			return string(b) == "cpu"
 		}

 		curr := b[:i]
 		rest := b[i+1:]

 		if string(curr) == "cpu" {
 			return true
 		}

 		b = rest
 	}

 	return false
 }

 // Returns the path to the specified cgroup and version with cpu controller
 //
 // fd is a file descriptor for /proc/self/mountinfo.
 // Returns the number of bytes written.
 func parseCPUMount(fd int, read func(fd int, b []byte) (int, uintptr), out, cgroup []byte, version Version, scratch []byte) (int, error) {
 	// The format of each line is:
 	//
 	// 36 35 98:0 /mnt1 /mnt2 rw,noatime master:1 - ext3 /dev/root rw,errors=continue
 	// (1)(2)(3)   (4)   (5)      (6)      (7)   (8) (9)   (10)         (11)
 	//
 	// (1) mount ID:  unique identifier of the mount (may be reused after umount)
 	// (2) parent ID:  ID of parent (or of self for the top of the mount tree)
 	// (3) major:minor:  value of st_dev for files on filesystem
 	// (4) root:  root of the mount within the filesystem
 	// (5) mount point:  mount point relative to the process's root
 	// (6) mount options:  per mount options
 	// (7) optional fields:  zero or more fields of the form "tag[:value]"
 	// (8) separator:  marks the end of the optional fields
 	// (9) filesystem type:  name of filesystem of the form "type[.subtype]"
 	// (10) mount source:  filesystem specific information or "none"
 	// (11) super options:  per super block options
 	//
 	// See man 5 proc_pid_mountinfo for more details.
 	//
 	// Note that emitted paths will not contain space, tab, newline, or
 	// carriage return. Those are escaped. See Linux show_mountinfo ->
 	// show_path. We must unescape before returning.
 	//
 	// A mount point matches if the filesystem type (9) is cgroup2,
 	// or cgroup with "cpu" in the super options (11),
 	// and the cgroup is in the root (4). If there are multiple matches,
 	// the first one is selected.
 	//
 	// We return full cgroup path, which is the mount point (5) +
 	// cgroup parameter without the root (4) prefix.
 	//
 	// (4), (5), and (10) are up to _PATH_MAX. The remaining fields have a
 	// small fixed maximum size, so 4*_PATH_MAX is plenty of scratch space.
 	// Note that non-cgroup mounts may have arbitrarily long (11), but we
 	// can skip those when parsing.

 	l := newLineReader(fd, scratch, read)

 	for {
 		err := l.next()
 		if err == errIncompleteLine {
 			// An incomplete line is fine as long as it doesn't
 			// impede parsing the fields we need. It shouldn't be
 			// possible for any mount to use more than 3*PATH_MAX
 			// before (9) because there are two paths and all other
 			// earlier fields have bounded options. Only (11) has
 			// unbounded options.
 		} else if err == errEOF {
 			break
 		} else if err != nil {
 			return 0, err
 		}

 		line := l.line()

 		// Skip first three fields.
 		for range 3 {
 			i := bytealg.IndexByte(line, ' ')
 			if i < 0 {
 				return 0, errMalformedFile
 			}
 			line = line[i+1:]
 		}

 		// (4) root:  root of the mount within the filesystem
 		i := bytealg.IndexByte(line, ' ')
 		if i < 0 {
 			return 0, errMalformedFile
 		}
 		root := line[:i]
 		if len(root) == 0 || root[0] != '/' {
 			// We rely on this in hasPathPrefix.
 			return 0, errMalformedFile
 		}
 		line = line[i+1:]

 		// (5) mount point:  mount point relative to the process's root
 		i = bytealg.IndexByte(line, ' ')
 		if i < 0 {
 			return 0, errMalformedFile
 		}
 		mnt := line[:i]
 		line = line[i+1:]

 		// Skip ahead past optional fields, delimited by " - ".
 		for {
 			i = bytealg.IndexByte(line, ' ')
 			if i < 0 {
 				return 0, errMalformedFile
 			}
 			if i+3 >= len(line) {
 				return 0, errMalformedFile
 			}
 			delim := line[i : i+3]
 			if string(delim) == " - " {
 				line = line[i+3:]
 				break
 			}
 			line = line[i+1:]
 		}

 		// (9) filesystem type:  name of filesystem of the form "type[.subtype]"
 		i = bytealg.IndexByte(line, ' ')
 		if i < 0 {
 			return 0, errMalformedFile
 		}
 		ftype := line[:i]
 		line = line[i+1:]

 		switch version {
 		case V1:
 			if string(ftype) != "cgroup" {
 				continue
 			}
 			// (10) mount source:  filesystem specific information or "none"
 			i = bytealg.IndexByte(line, ' ')
 			if i < 0 {
 				return 0, errMalformedFile
 			}
 			// Don't care about mount source.
 			line = line[i+1:]

 			// (11) super options:  per super block options
 			if !containsCPU(line) {
 				continue
 			}
 		case V2:
 			if string(ftype) != "cgroup2" {
 				continue
 			}
 		default:
 			throw("impossible cgroup version")
 			panic("unreachable")
 		}

 		// Check cgroup is in the root.
 		// If the cgroup is /sandbox/container, the matching mount point root could be
 		// /sandbox/container, /sandbox, or /
 		rootLen, err := unescapePath(root, root)
 		if err != nil {
 			return 0, err
 		}
 		root = root[:rootLen]
 		if !hasPathPrefix(cgroup, root) {
 			continue // not matched, this is not the mount point we're looking for
 		}

 		// Cutoff the root from cgroup, ensure rel starts with '/' or is empty.
 		rel := cgroup[rootLen:]
 		if rootLen == 1 && len(cgroup) > 1 {
 			// root is "/", but cgroup is not. Keep full cgroup path.
 			rel = cgroup
 		}
 		if hasPathPrefix(rel, []byte("/..")) {
 			// the cgroup is out of current cgroup namespace, and this mount point
 			// cannot reach that cgroup.
 			//
 			// e.g. If the process is in cgroup /init, but in a cgroup namespace
 			// rooted at /sandbox/container, /proc/self/cgroup will show /../../init.
 			// we can reach it if the mount point root is
 			// /../.. or /../../init, but not if it is /.. or /
 			// While mount point with root /../../.. should able to reach the cgroup,
 			// we don't know the path to the cgroup within that mount point.
 			continue
 		}

 		// All conditions met, compose the full path.
 		// Copy rel to the correct place first, it may overlap with out.
 		n := unescapedLen(mnt)
 		if n+len(rel) > len(out) {
 			return 0, errPathTooLong
 		}
 		copy(out[n:], rel)
 		n2, err := unescapePath(out[:n], mnt)
 		if err != nil {
 			return 0, err
 		}
 		if n2 != n {
 			throw("wrong unescaped len")
 		}
 		return n + len(rel), nil
 	}

 	// Found nothing.
 	return 0, ErrNoCgroup
 }

 func hasPathPrefix(p, prefix []byte) bool {
 	i := len(prefix)
 	if i == 1 {
 		return true // root contains everything
 	}
 	if len(p) < i || !bytealg.Equal(prefix, p[:i]) {
 		return false
 	}
 	return len(p) == i || p[i] == '/' // must match at path boundary
 }

 var (
 	errInvalidEscape error = stringError("invalid path escape sequence")
 	errPathTooLong   error = stringError("path too long")
 )

 func unescapedLen(in []byte) int {
 	return len(in) - bytealg.Count(in, byte('\\'))*3
 }

 // unescapePath copies in to out, unescaping escape sequences generated by
 // Linux's show_path.
 //
 // That is, '\', ' ', '\t', and '\n' are converted to octal escape sequences,
 // like '\040' for space.
 //
 // Caller must ensure that out at least has unescapedLen(in) bytes.
 // in and out may alias; in-place unescaping is supported.
 //
 // Returns the number of bytes written to out.
 //
 // Also see escapePath in cgroup_linux_test.go.
 func unescapePath(out []byte, in []byte) (int, error) {
 	var outi, ini int
 	for ini < len(in) {
 		if outi >= len(out) {
 			// given that caller already ensured out is long enough, this
 			// is only possible if there are malformed escape sequences
 			// we have not parsed yet.
 			return outi, errInvalidEscape
 		}
 		c := in[ini]
 		if c != '\\' {
 			out[outi] = c
 			outi++
 			ini++
 			continue
 		}

 		// Start of escape sequence.

 		// Escape sequence is always 4 characters: one slash and three
 		// digits.
 		if ini+3 >= len(in) {
 			return outi, errInvalidEscape
 		}

 		var outc int
 		for i := range 3 {
 			c := in[ini+1+i]
 			if c < '0' || c > '7' {
 				return outi, errInvalidEscape
 			}

 			outc *= 8
 			outc += int(c - '0')
 		}

 		if outc > 0xFF {
 			return outi, errInvalidEscape
 		}
 		out[outi] = byte(outc)
 		outi++

 		ini += 4
 	}

 	return outi, nil
 }
	// Copyright 2025 The Go Authors. All rights reserved.
	// Use of this source code is governed by a BSD-style
	// license that can be found in the LICENSE file.

	package cgroup

	import (
	"internal/bytealg"
	"internal/strconv"
	)

	var (
	ErrNoCgroup error = stringError("not in a cgroup")

	errMalformedFile error = stringError("malformed file")
	)

	const _PATH_MAX = 4096

	const (
	// Required amount of scratch space for CPULimit.
	//
	// TODO(prattmic): This is shockingly large (~70KiB) due to the (very
	// unlikely) combination of extremely long paths consisting mostly
	// escaped characters. The scratch buffer ends up in .bss in package
	// runtime, so it doesn't contribute to binary size and generally won't
	// be faulted in, but it would still be nice to shrink this. A more
	// complex parser that did not need to keep entire lines in memory
	// could get away with much less. Alternatively, we could do a one-off
	// mmap allocation for this buffer, which is only mapped larger if we
	// actually need the extra space.
	ScratchSize = PathSize + ParseSize

	// Required space to store a path of the cgroup in the filesystem.
	PathSize = _PATH_MAX

	// /proc/self/mountinfo path escape sequences are 4 characters long, so
	// a path consisting entirely of escaped characters could be 4 times
	// larger.
	escapedPathMax = 4 * _PATH_MAX

	// Required space to parse /proc/self/mountinfo and /proc/self/cgroup.
	// See findCPUMount and findCPURelativePath.
	ParseSize = 4 * escapedPathMax
	)

	// Version indicates the cgroup version.
	type Version int

	const (
	VersionUnknown Version = iota
	V1
	V2
	)

	func parseV1Number(buf []byte) (int64, error) {
	// Ignore trailing newline.
	i := bytealg.IndexByte(buf, '\n')
	if i < 0 {
	return 0, errMalformedFile
	}
	buf = buf[:i]

	val, err := strconv.ParseInt(string(buf), 10, 64)
	if err != nil {
	return 0, errMalformedFile
	}

	return val, nil
	}

	func parseV2Limit(buf []byte) (float64, bool, error) {
	i := bytealg.IndexByte(buf, ' ')
	if i < 0 {
	return 0, false, errMalformedFile
	}

	quotaStr := buf[:i]
	if bytealg.Compare(quotaStr, []byte("max")) == 0 {
	// No limit.
	return 0, false, nil
	}

	periodStr := buf[i+1:]
	// Ignore trailing newline, if any.
	i = bytealg.IndexByte(periodStr, '\n')
	if i < 0 {
	return 0, false, errMalformedFile
	}
	periodStr = periodStr[:i]

	quota, err := strconv.ParseInt(string(quotaStr), 10, 64)
	if err != nil {
	return 0, false, errMalformedFile
	}

	period, err := strconv.ParseInt(string(periodStr), 10, 64)
	if err != nil {
	return 0, false, errMalformedFile
	}

	return float64(quota) / float64(period), true, nil
	}

	// Finds the path of the current process's CPU cgroup and writes it to out.
	//
	// fd is a file descriptor for /proc/self/cgroup.
	// Returns the number of bytes written and the cgroup version (1 or 2).
	func parseCPUCgroup(fd int, read func(fd int, b []byte) (int, uintptr), out []byte, scratch []byte) (int, Version, error) {
	// The format of each line is
	//
	// hierarchy-ID:controller-list:cgroup-path
	//
	// controller-list is comma-separated.
	//
	// cgroup v2 has hierarchy-ID 0. If a v1 hierarchy contains "cpu", that
	// is the CPU controller. Otherwise the v2 hierarchy (if any) is the
	// CPU controller. It is not possible to mount the same controller
	// simultaneously under both the v1 and the v2 hierarchies.
	//
	// See man 7 cgroups for more details.
	//
	// hierarchy-ID and controller-list have relatively small maximum
	// sizes, and the path can be up to _PATH_MAX, so we need a bit more
	// than 1 _PATH_MAX of scratch space.

	l := newLineReader(fd, scratch, read)

	// Bytes written to out.
	n := 0

	for {
	err := l.next()
	if err == errIncompleteLine {
	// Don't allow incomplete lines. While in theory the
	// incomplete line may be for a controller we don't
	// care about, in practice all lines should be of
	// similar length, so we should just have a buffer big
	// enough for any.
	return 0, 0, err
	} else if err == errEOF {
	break
	} else if err != nil {
	return 0, 0, err
	}

	line := l.line()

	// The format of each line is
	//
	// hierarchy-ID:controller-list:cgroup-path
	//
	// controller-list is comma-separated.
	// See man 7 cgroups for more details.
	i := bytealg.IndexByte(line, ':')
	if i < 0 {
	return 0, 0, errMalformedFile
	}

	hierarchy := line[:i]
	line = line[i+1:]

	i = bytealg.IndexByte(line, ':')
	if i < 0 {
	return 0, 0, errMalformedFile
	}

	controllers := line[:i]
	line = line[i+1:]

	path := line
	if len(path) == 0 \|\| path[0] != '/' {
	// We rely on this when composing the full path.
	return 0, 0, errMalformedFile
	}
	if len(path) > len(out) {
	// Should not be possible. If we really get a very long cgroup path,
	// read /proc/self/cgroup will fail with ENAMETOOLONG.
	return 0, 0, errPathTooLong
	}

	if string(hierarchy) == "0" {
	// v2 hierarchy.
	n = copy(out, path)
	// Keep searching, we might find a v1 hierarchy with a
	// CPU controller, which takes precedence.
	} else {
	// v1 hierarchy
	if containsCPU(controllers) {
	// Found a v1 CPU controller. This must be the
	// only one, so we're done.
	return copy(out, path), V1, nil
	}
	}
	}

	if n == 0 {
	// Found nothing.
	return 0, 0, ErrNoCgroup
	}

	// Must be v2, v1 returns above.
	return n, V2, nil
	}

	// Returns true if comma-separated list b contains "cpu".
	func containsCPU(b []byte) bool {
	for len(b) > 0 {
	i := bytealg.IndexByte(b, ',')
	if i < 0 {
	// Neither cmd/compile nor gccgo allocates for these string conversions.
	return string(b) == "cpu"
	}

	curr := b[:i]
	rest := b[i+1:]

	if string(curr) == "cpu" {
	return true
	}

	b = rest
	}

	return false
	}

	// Returns the path to the specified cgroup and version with cpu controller
	//
	// fd is a file descriptor for /proc/self/mountinfo.
	// Returns the number of bytes written.
	func parseCPUMount(fd int, read func(fd int, b []byte) (int, uintptr), out, cgroup []byte, version Version, scratch []byte) (int, error) {
	// The format of each line is:
	//
	// 36 35 98:0 /mnt1 /mnt2 rw,noatime master:1 - ext3 /dev/root rw,errors=continue
	// (1)(2)(3) (4) (5) (6) (7) (8) (9) (10) (11)
	//
	// (1) mount ID: unique identifier of the mount (may be reused after umount)
	// (2) parent ID: ID of parent (or of self for the top of the mount tree)
	// (3) major:minor: value of st_dev for files on filesystem
	// (4) root: root of the mount within the filesystem
	// (5) mount point: mount point relative to the process's root
	// (6) mount options: per mount options
	// (7) optional fields: zero or more fields of the form "tag[:value]"
	// (8) separator: marks the end of the optional fields
	// (9) filesystem type: name of filesystem of the form "type[.subtype]"
	// (10) mount source: filesystem specific information or "none"
	// (11) super options: per super block options
	//
	// See man 5 proc_pid_mountinfo for more details.
	//
	// Note that emitted paths will not contain space, tab, newline, or
	// carriage return. Those are escaped. See Linux show_mountinfo ->
	// show_path. We must unescape before returning.
	//
	// A mount point matches if the filesystem type (9) is cgroup2,
	// or cgroup with "cpu" in the super options (11),
	// and the cgroup is in the root (4). If there are multiple matches,
	// the first one is selected.
	//
	// We return full cgroup path, which is the mount point (5) +
	// cgroup parameter without the root (4) prefix.
	//
	// (4), (5), and (10) are up to _PATH_MAX. The remaining fields have a
	// small fixed maximum size, so 4*_PATH_MAX is plenty of scratch space.
	// Note that non-cgroup mounts may have arbitrarily long (11), but we
	// can skip those when parsing.

	l := newLineReader(fd, scratch, read)

	for {
	err := l.next()
	if err == errIncompleteLine {
	// An incomplete line is fine as long as it doesn't
	// impede parsing the fields we need. It shouldn't be
	// possible for any mount to use more than 3*PATH_MAX
	// before (9) because there are two paths and all other
	// earlier fields have bounded options. Only (11) has
	// unbounded options.
	} else if err == errEOF {
	break
	} else if err != nil {
	return 0, err
	}

	line := l.line()

	// Skip first three fields.
	for range 3 {
	i := bytealg.IndexByte(line, ' ')
	if i < 0 {
	return 0, errMalformedFile
	}
	line = line[i+1:]
	}

	// (4) root: root of the mount within the filesystem
	i := bytealg.IndexByte(line, ' ')
	if i < 0 {
	return 0, errMalformedFile
	}
	root := line[:i]
	if len(root) == 0 \|\| root[0] != '/' {
	// We rely on this in hasPathPrefix.
	return 0, errMalformedFile
	}
	line = line[i+1:]

	// (5) mount point: mount point relative to the process's root
	i = bytealg.IndexByte(line, ' ')
	if i < 0 {
	return 0, errMalformedFile
	}
	mnt := line[:i]
	line = line[i+1:]

	// Skip ahead past optional fields, delimited by " - ".
	for {
	i = bytealg.IndexByte(line, ' ')
	if i < 0 {
	return 0, errMalformedFile
	}
	if i+3 >= len(line) {
	return 0, errMalformedFile
	}
	delim := line[i : i+3]
	if string(delim) == " - " {
	line = line[i+3:]
	break
	}
	line = line[i+1:]
	}

	// (9) filesystem type: name of filesystem of the form "type[.subtype]"
	i = bytealg.IndexByte(line, ' ')
	if i < 0 {
	return 0, errMalformedFile
	}
	ftype := line[:i]
	line = line[i+1:]

	switch version {
	case V1:
	if string(ftype) != "cgroup" {
	continue
	}
	// (10) mount source: filesystem specific information or "none"
	i = bytealg.IndexByte(line, ' ')
	if i < 0 {
	return 0, errMalformedFile
	}
	// Don't care about mount source.
	line = line[i+1:]

	// (11) super options: per super block options
	if !containsCPU(line) {
	continue
	}
	case V2:
	if string(ftype) != "cgroup2" {
	continue
	}
	default:
	throw("impossible cgroup version")
	panic("unreachable")
	}

	// Check cgroup is in the root.
	// If the cgroup is /sandbox/container, the matching mount point root could be
	// /sandbox/container, /sandbox, or /
	rootLen, err := unescapePath(root, root)
	if err != nil {
	return 0, err
	}
	root = root[:rootLen]
	if !hasPathPrefix(cgroup, root) {
	continue // not matched, this is not the mount point we're looking for
	}

	// Cutoff the root from cgroup, ensure rel starts with '/' or is empty.
	rel := cgroup[rootLen:]
	if rootLen == 1 && len(cgroup) > 1 {
	// root is "/", but cgroup is not. Keep full cgroup path.
	rel = cgroup
	}
	if hasPathPrefix(rel, []byte("/..")) {
	// the cgroup is out of current cgroup namespace, and this mount point
	// cannot reach that cgroup.
	//
	// e.g. If the process is in cgroup /init, but in a cgroup namespace
	// rooted at /sandbox/container, /proc/self/cgroup will show /../../init.
	// we can reach it if the mount point root is
	// /../.. or /../../init, but not if it is /.. or /
	// While mount point with root /../../.. should able to reach the cgroup,
	// we don't know the path to the cgroup within that mount point.
	continue
	}

	// All conditions met, compose the full path.
	// Copy rel to the correct place first, it may overlap with out.
	n := unescapedLen(mnt)
	if n+len(rel) > len(out) {
	return 0, errPathTooLong
	}
	copy(out[n:], rel)
	n2, err := unescapePath(out[:n], mnt)
	if err != nil {
	return 0, err
	}
	if n2 != n {
	throw("wrong unescaped len")
	}
	return n + len(rel), nil
	}

	// Found nothing.
	return 0, ErrNoCgroup
	}

	func hasPathPrefix(p, prefix []byte) bool {
	i := len(prefix)
	if i == 1 {
	return true // root contains everything
	}
	if len(p) < i \|\| !bytealg.Equal(prefix, p[:i]) {
	return false
	}
	return len(p) == i \|\| p[i] == '/' // must match at path boundary
	}

	var (
	errInvalidEscape error = stringError("invalid path escape sequence")
	errPathTooLong error = stringError("path too long")
	)

	func unescapedLen(in []byte) int {
	return len(in) - bytealg.Count(in, byte('\\'))*3
	}

	// unescapePath copies in to out, unescaping escape sequences generated by
	// Linux's show_path.
	//
	// That is, '\', ' ', '\t', and '\n' are converted to octal escape sequences,
	// like '\040' for space.
	//
	// Caller must ensure that out at least has unescapedLen(in) bytes.
	// in and out may alias; in-place unescaping is supported.
	//
	// Returns the number of bytes written to out.
	//
	// Also see escapePath in cgroup_linux_test.go.
	func unescapePath(out []byte, in []byte) (int, error) {
	var outi, ini int
	for ini < len(in) {
	if outi >= len(out) {
	// given that caller already ensured out is long enough, this
	// is only possible if there are malformed escape sequences
	// we have not parsed yet.
	return outi, errInvalidEscape
	}
	c := in[ini]
	if c != '\\' {
	out[outi] = c
	outi++
	ini++
	continue
	}

	// Start of escape sequence.

	// Escape sequence is always 4 characters: one slash and three
	// digits.
	if ini+3 >= len(in) {
	return outi, errInvalidEscape
	}

	var outc int
	for i := range 3 {
	c := in[ini+1+i]
	if c < '0' \|\| c > '7' {
	return outi, errInvalidEscape
	}

	outc *= 8
	outc += int(c - '0')
	}

	if outc > 0xFF {
	return outi, errInvalidEscape
	}
	out[outi] = byte(outc)
	outi++

	ini += 4
	}

	return outi, nil
	}