bpf_program__set_log_buf() checks the existing prog->log_size instead of the incoming log_size argument when enforcing the UINT_MAX limit. As a result, an oversized value can be accepted. The setter also accepts a non-NULL log_buf with a zero log_size, while bpf_prog_load() rejects mismatched log buffer and size values. Validate the log buffer and size pair consistently with bpf_prog_load(), and check the supplied log_size against UINT_MAX. Signed-off-by: Luis Vieira --- Changes in v2: - Target bpf-next instead of bpf and drop the Fixes tag. - Drop the regression selftest. - Validate log_buf and log_size consistently with bpf_prog_load(). - Link to v1: https://patch.msgid.link/20260914-libbpf-log-buf-fix-v1-1-f592caffcc71@gmail.com To: Andrii Nakryiko To: Eduard Zingerman To: Ihor Solodrai To: Alexei Starovoitov To: Daniel Borkmann To: Kumar Kartikeya Dwivedi To: Martin KaFai Lau To: Song Liu To: Yonghong Song To: Jiri Olsa To: Emil Tsalapatis Cc: bpf@vger.kernel.org Cc: linux-kernel@vger.kernel.org --- tools/lib/bpf/libbpf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c index 613afae26519..f7a0517d8fa8 100644 --- a/tools/lib/bpf/libbpf.c +++ b/tools/lib/bpf/libbpf.c @@ -9966,9 +9966,9 @@ const char *bpf_program__log_buf(const struct bpf_program *prog, size_t *log_siz int bpf_program__set_log_buf(struct bpf_program *prog, char *log_buf, size_t log_size) { - if (log_size && !log_buf) + if (!!log_buf != !!log_size) return libbpf_err(-EINVAL); - if (prog->log_size > UINT_MAX) + if (log_size > UINT_MAX) return libbpf_err(-EINVAL); if (prog->obj->state >= OBJ_LOADED) return libbpf_err(-EBUSY); --- base-commit: 5ef40d69b38a93bc9951dadb1a15c85c597e1a40 change-id: 20260913-libbpf-log-buf-fix-49f5038caa5d Best regards, -- Luis Vieira