From 8afaa19944d588fc0dd90547b44162dc092129a6 Mon Sep 17 00:00:00 2001 From: Luis Vieira Date: Tue, 15 Sep 2026 15:13:35 -0300 Subject: [PATCH] libbpf: Fix program log buffer size validation bpf_program__set_log_buf() checks the existing prog->log_size instead of the incoming log_size argument when enforcing the UINT_MAX limit. As a result, an oversized value can be accepted. The setter also accepts a non-NULL log_buf with a zero log_size, while bpf_prog_load() rejects mismatched log buffer and size values. Validate the log buffer and size pair consistently with bpf_prog_load(), and check the supplied log_size against UINT_MAX. Signed-off-by: Luis Vieira Signed-off-by: Andrii Nakryiko Acked-by: Mykyta Yatsenko Link: https://lore.kernel.org/bpf/20260915-libbpf-log-buf-fix-v2-1-2feca3fa4842@gmail.com --- src/libbpf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/libbpf.c b/src/libbpf.c index 613afae..f7a0517 100644 --- a/src/libbpf.c +++ b/src/libbpf.c @@ -9966,9 +9966,9 @@ const char *bpf_program__log_buf(const struct bpf_program *prog, size_t *log_siz int bpf_program__set_log_buf(struct bpf_program *prog, char *log_buf, size_t log_size) { - if (log_size && !log_buf) + if (!!log_buf != !!log_size) return libbpf_err(-EINVAL); - if (prog->log_size > UINT_MAX) + if (log_size > UINT_MAX) return libbpf_err(-EINVAL); if (prog->obj->state >= OBJ_LOADED) return libbpf_err(-EBUSY);