[PATCH bpf v1 1/1] libbpf: Fix out-of-bound read in bpf_linker__add_buf()

[PATCH bpf v1 1/1] libbpf: Fix out-of-bound read in bpf_linker__add_buf()

[Amery Hung]

Fix a potential out-of-bound read in bpf_linker__add_buf() by advancing
the buffer pointer and reducing the remaining buffer size passed to
write() in each iteration. The bug is reported in [0].

[0]: https://github.com/libbpf/libbpf/issues/945

Fixes: 6d5e5e5d7ce1 ("libbpf: Extend linker API to support in-memory ELF files")
Signed-off-by: Amery Hung <ameryhung@gmail.com>
---
 tools/lib/bpf/linker.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/lib/bpf/linker.c b/tools/lib/bpf/linker.c
index f4403e3cf994..78f92c39290a 100644
--- a/tools/lib/bpf/linker.c
+++ b/tools/lib/bpf/linker.c
@@ -581,7 +581,7 @@ int bpf_linker__add_buf(struct bpf_linker *linker, void *buf, size_t buf_sz,
 
 	written = 0;
 	while (written < buf_sz) {
-		ret = write(fd, buf, buf_sz);
+		ret = write(fd, buf + written, buf_sz - written);
 		if (ret < 0) {
 			ret = -errno;
 			pr_warn("failed to write '%s': %s\n", filename, errstr(ret));
-- 
2.47.3

Re: [PATCH bpf v1 1/1] libbpf: Fix out-of-bound read in bpf_linker__add_buf()

[Jiri Olsa]

On Mon, Feb 09, 2026 at 03:01:34PM -0800, Amery Hung wrote:
> Fix a potential out-of-bound read in bpf_linker__add_buf() by advancing
> the buffer pointer and reducing the remaining buffer size passed to
> write() in each iteration. The bug is reported in [0].
> 
> [0]: https://github.com/libbpf/libbpf/issues/945
> 
> Fixes: 6d5e5e5d7ce1 ("libbpf: Extend linker API to support in-memory ELF files")
> Signed-off-by: Amery Hung <ameryhung@gmail.com>

Acked-by: Jiri Olsa <jolsa@kernel.org>

jirka


> ---
>  tools/lib/bpf/linker.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/tools/lib/bpf/linker.c b/tools/lib/bpf/linker.c
> index f4403e3cf994..78f92c39290a 100644
> --- a/tools/lib/bpf/linker.c
> +++ b/tools/lib/bpf/linker.c
> @@ -581,7 +581,7 @@ int bpf_linker__add_buf(struct bpf_linker *linker, void *buf, size_t buf_sz,
>  
>  	written = 0;
>  	while (written < buf_sz) {
> -		ret = write(fd, buf, buf_sz);
> +		ret = write(fd, buf + written, buf_sz - written);
>  		if (ret < 0) {
>  			ret = -errno;
>  			pr_warn("failed to write '%s': %s\n", filename, errstr(ret));
> -- 
> 2.47.3
> 
> 

Re: [PATCH bpf v1 1/1] libbpf: Fix out-of-bound read in bpf_linker__add_buf()

[Andrii Nakryiko]

On Mon, Feb 9, 2026 at 3:01 PM Amery Hung <ameryhung@gmail.com> wrote:
>
> Fix a potential out-of-bound read in bpf_linker__add_buf() by advancing
> the buffer pointer and reducing the remaining buffer size passed to
> write() in each iteration. The bug is reported in [0].
>
> [0]: https://github.com/libbpf/libbpf/issues/945
>
> Fixes: 6d5e5e5d7ce1 ("libbpf: Extend linker API to support in-memory ELF files")
> Signed-off-by: Amery Hung <ameryhung@gmail.com>
> ---
>  tools/lib/bpf/linker.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/tools/lib/bpf/linker.c b/tools/lib/bpf/linker.c
> index f4403e3cf994..78f92c39290a 100644
> --- a/tools/lib/bpf/linker.c
> +++ b/tools/lib/bpf/linker.c
> @@ -581,7 +581,7 @@ int bpf_linker__add_buf(struct bpf_linker *linker, void *buf, size_t buf_sz,
>
>         written = 0;
>         while (written < buf_sz) {
> -               ret = write(fd, buf, buf_sz);
> +               ret = write(fd, buf + written, buf_sz - written);

The bug fix is correct, but commit description is off. There will be
no out-of-bounds reads, we'll just corrupt memfd contents and almost
certainly won't be able to parse result ELF file correctly. I've
adjusted the description as follows and pushed to bpf, thanks

    libbpf: Fix invalid write loop logic in bpf_linker__add_buf()

    Fix bpf_linker__add_buf()'s logic of copying data from memory buffer into
    memfd. In the event of short write not writing entire buf_sz bytes
into memfd
    file, we'll append bytes from the beginning of buf *again* (corrupting ELF
    file contents) instead of correctly appending the rest of not-yet-read buf
    contents.


>                 if (ret < 0) {
>                         ret = -errno;
>                         pr_warn("failed to write '%s': %s\n", filename, errstr(ret));
> --
> 2.47.3
>
>