[PATCH bpf] libbpf: Fix program log buffer size validation

[PATCH bpf] libbpf: Fix program log buffer size validation

[Luis Vieira]

bpf_program__set_log_buf() intends to reject log buffer sizes larger
than UINT_MAX.

However, the function checks the existing prog->log_size instead of
the incoming log_size argument. As a result, an oversized value can
be accepted.

Validate the supplied log_size instead.

Add a regression test that verifies that values larger than UINT_MAX
are rejected with -EINVAL on platforms where size_t can represent
such values.

Fixes: b3ce90795035 ("libbpf: Add per-program log buffer setter and getter")
Signed-off-by: Luis Vieira <luisflavieira@gmail.com>
---
 tools/lib/bpf/libbpf.c                           |  2 +-
 tools/testing/selftests/bpf/prog_tests/log_buf.c | 25 ++++++++++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index b749c01742ee..e1fed7735614 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -9955,7 +9955,7 @@ int bpf_program__set_log_buf(struct bpf_program *prog, char *log_buf, size_t log
 {
 	if (log_size && !log_buf)
 		return libbpf_err(-EINVAL);
-	if (prog->log_size > UINT_MAX)
+	if (log_size > UINT_MAX)
 		return libbpf_err(-EINVAL);
 	if (prog->obj->state >= OBJ_LOADED)
 		return libbpf_err(-EBUSY);
diff --git a/tools/testing/selftests/bpf/prog_tests/log_buf.c b/tools/testing/selftests/bpf/prog_tests/log_buf.c
index d6f14a232002..31c842d27fb4 100644
--- a/tools/testing/selftests/bpf/prog_tests/log_buf.c
+++ b/tools/testing/selftests/bpf/prog_tests/log_buf.c
@@ -3,6 +3,8 @@
 
 #include <test_progs.h>
 #include <bpf/btf.h>
+#include <limits.h>
+#include <stdint.h>
 
 #include "test_log_buf.skel.h"
 #include "bpf_util.h"
@@ -267,6 +269,27 @@ static void bpf_btf_load_log_buf(void)
 	btf__free(btf);
 }
 
+static void prog_log_buf_size_limit(void)
+{
+#if SIZE_MAX > UINT_MAX
+	struct test_log_buf *skel;
+	char log_buf[1];
+	int err;
+
+	skel = test_log_buf__open();
+	if (!ASSERT_OK_PTR(skel, "skel_open"))
+		return;
+
+	err = bpf_program__set_log_buf(skel->progs.good_prog, log_buf,
+				       (size_t)UINT_MAX + 1);
+	ASSERT_EQ(err, -EINVAL, "set_log_buf_too_big");
+
+	test_log_buf__destroy(skel);
+#else
+	test__skip();
+#endif
+}
+
 void test_log_buf(void)
 {
 	if (test__start_subtest("obj_load_log_buf"))
@@ -275,4 +298,6 @@ void test_log_buf(void)
 		bpf_prog_load_log_buf();
 	if (test__start_subtest("bpf_btf_load_log_buf"))
 		bpf_btf_load_log_buf();
+	if (test__start_subtest("prog_log_buf_size_limit"))
+		prog_log_buf_size_limit();
 }

---
base-commit: ee363e055895364039bf28348ff13c615afad4ba
change-id: 20260913-libbpf-log-buf-fix-49f5038caa5d

Best regards,
--  
Luis Vieira <luisflavieira@gmail.com>

Re: [PATCH bpf] libbpf: Fix program log buffer size validation

[Mykyta Yatsenko]

On 9/14/26 12:50 PM, Luis Vieira wrote:
> bpf_program__set_log_buf() intends to reject log buffer sizes larger
> than UINT_MAX.
> 
> However, the function checks the existing prog->log_size instead of
> the incoming log_size argument. As a result, an oversized value can
> be accepted.
> 
> Validate the supplied log_size instead.
> 
> Add a regression test that verifies that values larger than UINT_MAX
> are rejected with -EINVAL on platforms where size_t can represent
> such values.
> 
> Fixes: b3ce90795035 ("libbpf: Add per-program log buffer setter and getter")
> Signed-off-by: Luis Vieira <luisflavieira@gmail.com>
> ---

The change looks correct, few questions:
 * Do we really need a unit test for this? We are not testing those error
conditions now.
 * While here should we rewrite the first check as (!!log_buf != !!log_size), to
cover the case when log_size == 0 but log_buf is nonnull (we check it later in
bpf_prog_load()) (AI)
 * Fixes tag is probably not needed, because this is libbpf, target bpf-next.

>  tools/lib/bpf/libbpf.c                           |  2 +-
>  tools/testing/selftests/bpf/prog_tests/log_buf.c | 25 ++++++++++++++++++++++++
>  2 files changed, 26 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> index b749c01742ee..e1fed7735614 100644
> --- a/tools/lib/bpf/libbpf.c
> +++ b/tools/lib/bpf/libbpf.c
> @@ -9955,7 +9955,7 @@ int bpf_program__set_log_buf(struct bpf_program *prog, char *log_buf, size_t log
>  {
>  	if (log_size && !log_buf)
>  		return libbpf_err(-EINVAL);
> -	if (prog->log_size > UINT_MAX)
> +	if (log_size > UINT_MAX)
>  		return libbpf_err(-EINVAL);
>  	if (prog->obj->state >= OBJ_LOADED)
>  		return libbpf_err(-EBUSY);
> diff --git a/tools/testing/selftests/bpf/prog_tests/log_buf.c b/tools/testing/selftests/bpf/prog_tests/log_buf.c
> index d6f14a232002..31c842d27fb4 100644
> --- a/tools/testing/selftests/bpf/prog_tests/log_buf.c
> +++ b/tools/testing/selftests/bpf/prog_tests/log_buf.c
> @@ -3,6 +3,8 @@
>  
>  #include <test_progs.h>
>  #include <bpf/btf.h>
> +#include <limits.h>
> +#include <stdint.h>
>  
>  #include "test_log_buf.skel.h"
>  #include "bpf_util.h"
> @@ -267,6 +269,27 @@ static void bpf_btf_load_log_buf(void)
>  	btf__free(btf);
>  }
>  
> +static void prog_log_buf_size_limit(void)
> +{
> +#if SIZE_MAX > UINT_MAX
> +	struct test_log_buf *skel;
> +	char log_buf[1];
> +	int err;
> +
> +	skel = test_log_buf__open();
> +	if (!ASSERT_OK_PTR(skel, "skel_open"))
> +		return;
> +
> +	err = bpf_program__set_log_buf(skel->progs.good_prog, log_buf,
> +				       (size_t)UINT_MAX + 1);
> +	ASSERT_EQ(err, -EINVAL, "set_log_buf_too_big");
> +
> +	test_log_buf__destroy(skel);
> +#else
> +	test__skip();
> +#endif
> +}
> +
>  void test_log_buf(void)
>  {
>  	if (test__start_subtest("obj_load_log_buf"))
> @@ -275,4 +298,6 @@ void test_log_buf(void)
>  		bpf_prog_load_log_buf();
>  	if (test__start_subtest("bpf_btf_load_log_buf"))
>  		bpf_btf_load_log_buf();
> +	if (test__start_subtest("prog_log_buf_size_limit"))
> +		prog_log_buf_size_limit();
>  }
> 
> ---
> base-commit: ee363e055895364039bf28348ff13c615afad4ba
> change-id: 20260913-libbpf-log-buf-fix-49f5038caa5d
> 
> Best regards,
> --  
> Luis Vieira <luisflavieira@gmail.com>
> 
> 

Re: [PATCH bpf] libbpf: Fix program log buffer size validation

[Luís Vieira]

On Mon, Sep 14, 2026 at 10:22 AM Mykyta Yatsenko
<mykyta.yatsenko5@gmail.com> wrote:
> The change looks correct, few questions:
>  * Do we really need a unit test for this? We are not testing those error
> conditions now.

Agreed. I'll drop the selftest in v2.

>  * While here should we rewrite the first check as (!!log_buf != !!log_size), to
> cover the case when log_size == 0 but log_buf is nonnull (we check it later in
> bpf_prog_load()) (AI)

Makes sense. I'll update the setter to validate the buffer/size pair
consistently with bpf_prog_load().

>  * Fixes tag is probably not needed, because this is libbpf, target bpf-next.

Agreed. I'll retarget v2 to bpf-next and drop the Fixes tag.

Thanks for the review.