libbpf: Fix program log buffer size validation

bpf_program__set_log_buf() checks the existing prog->log_size instead
of the incoming log_size argument when enforcing the UINT_MAX limit.
As a result, an oversized value can be accepted.

The setter also accepts a non-NULL log_buf with a zero log_size, while
bpf_prog_load() rejects mismatched log buffer and size values.

Validate the log buffer and size pair consistently with bpf_prog_load(),
and check the supplied log_size against UINT_MAX.

Signed-off-by: Luis Vieira <luisflavieira@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Mykyta Yatsenko <yatsenko@meta.com>
Link: https://lore.kernel.org/bpf/20260915-libbpf-log-buf-fix-v2-1-2feca3fa4842@gmail.com
This commit is contained in:
Luis Vieira authored and Andrii Nakryiko committed 2026-10-02 05:41:50 -07:00
1 parent 0f9c5a8d04
commit 8afaa19944
1 file changed
+2 -2
+2 -2
View File
@@ -9966,9 +9966,9 @@ const char *bpf_program__log_buf(const struct bpf_program *prog, size_t *log_siz
int bpf_program__set_log_buf(struct bpf_program *prog, char *log_buf, size_t log_size)
{
if (log_size && !log_buf)
if (!!log_buf != !!log_size)
return libbpf_err(-EINVAL);
if (prog->log_size > UINT_MAX)
if (log_size > UINT_MAX)
return libbpf_err(-EINVAL);
if (prog->obj->state >= OBJ_LOADED)
return libbpf_err(-EBUSY);