bpf_program__set_log_buf() intends to reject log buffer sizes larger
than UINT_MAX.
However, the function checks the existing prog->log_size instead of
the incoming log_size argument. As a result, an oversized value can
be accepted.
Validate the supplied log_size instead.
Add a regression test that verifies that values larger than UINT_MAX
are rejected with -EINVAL on platforms where size_t can represent
such values.
Fixes: b3ce90795035 ("libbpf: Add per-program log buffer setter and getter")
Signed-off-by: Luis Vieira <[email protected]>
---
tools/lib/bpf/libbpf.c | 2 +-
tools/testing/selftests/bpf/prog_tests/log_buf.c | 25 ++++++++++++++++++++++++
2 files changed, 26 insertions(+), 1 deletion(-)
diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index b749c01742ee..e1fed7735614 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -9955,7 +9955,7 @@ int bpf_program__set_log_buf(struct bpf_program *prog,
char *log_buf, size_t log
{
if (log_size && !log_buf)
return libbpf_err(-EINVAL);
- if (prog->log_size > UINT_MAX)
+ if (log_size > UINT_MAX)
return libbpf_err(-EINVAL);
if (prog->obj->state >= OBJ_LOADED)
return libbpf_err(-EBUSY);
diff --git a/tools/testing/selftests/bpf/prog_tests/log_buf.c
b/tools/testing/selftests/bpf/prog_tests/log_buf.c
index d6f14a232002..31c842d27fb4 100644
--- a/tools/testing/selftests/bpf/prog_tests/log_buf.c
+++ b/tools/testing/selftests/bpf/prog_tests/log_buf.c
@@ -3,6 +3,8 @@
#include <test_progs.h>
#include <bpf/btf.h>
+#include <limits.h>
+#include <stdint.h>
#include "test_log_buf.skel.h"
#include "bpf_util.h"
@@ -267,6 +269,27 @@ static void bpf_btf_load_log_buf(void)
btf__free(btf);
}
+static void prog_log_buf_size_limit(void)
+{
+#if SIZE_MAX > UINT_MAX
+ struct test_log_buf *skel;
+ char log_buf[1];
+ int err;
+
+ skel = test_log_buf__open();
+ if (!ASSERT_OK_PTR(skel, "skel_open"))
+ return;
+
+ err = bpf_program__set_log_buf(skel->progs.good_prog, log_buf,
+ (size_t)UINT_MAX + 1);
+ ASSERT_EQ(err, -EINVAL, "set_log_buf_too_big");
+
+ test_log_buf__destroy(skel);
+#else
+ test__skip();
+#endif
+}
+
void test_log_buf(void)
{
if (test__start_subtest("obj_load_log_buf"))
@@ -275,4 +298,6 @@ void test_log_buf(void)
bpf_prog_load_log_buf();
if (test__start_subtest("bpf_btf_load_log_buf"))
bpf_btf_load_log_buf();
+ if (test__start_subtest("prog_log_buf_size_limit"))
+ prog_log_buf_size_limit();
}
---
base-commit: ee363e055895364039bf28348ff13c615afad4ba
change-id: 20260913-libbpf-log-buf-fix-49f5038caa5d
Best regards,
--
Luis Vieira <[email protected]>
