Re: [PATCH bpf v1 1/1] libbpf: Fix out-of-bound read in bpf_linker__add_buf()

[Jiri Olsa <olsajiri@gmail.com>]

On Mon, Feb 09, 2026 at 03:01:34PM -0800, Amery Hung wrote:
> Fix a potential out-of-bound read in bpf_linker__add_buf() by advancing
> the buffer pointer and reducing the remaining buffer size passed to
> write() in each iteration. The bug is reported in [0].
> 
> [0]: https://github.com/libbpf/libbpf/issues/945
> 
> Fixes: 6d5e5e5d7ce1 ("libbpf: Extend linker API to support in-memory ELF files")
> Signed-off-by: Amery Hung <ameryhung@gmail.com>

Acked-by: Jiri Olsa <jolsa@kernel.org>

jirka


> ---
>  tools/lib/bpf/linker.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/tools/lib/bpf/linker.c b/tools/lib/bpf/linker.c
> index f4403e3cf994..78f92c39290a 100644
> --- a/tools/lib/bpf/linker.c
> +++ b/tools/lib/bpf/linker.c
> @@ -581,7 +581,7 @@ int bpf_linker__add_buf(struct bpf_linker *linker, void *buf, size_t buf_sz,
>  
>  	written = 0;
>  	while (written < buf_sz) {
> -		ret = write(fd, buf, buf_sz);
> +		ret = write(fd, buf + written, buf_sz - written);
>  		if (ret < 0) {
>  			ret = -errno;
>  			pr_warn("failed to write '%s': %s\n", filename, errstr(ret));
> -- 
> 2.47.3
> 
>