[PATCH bpf-next v3] libbpf: Report error when a negative kprobe offset is specified

[PATCH bpf-next v3] libbpf: Report error when a negative kprobe offset is specified

[Aaron Tomlin]

In attach_kprobe(), the parsing logic uses sscanf() to extract the
target function name and offset from the section definition. Currently,
if a user specifies a negative offset (e.g., SEC("kprobe/func+-100")),
the input is not explicitly caught and reported as an error.

This commit updates the logic to explicitly notify the user when a
negative integer is provided. To facilitate this check, the offset
variable is changed from unsigned long to long so that sscanf()
can accurately capture a negative input for evaluation.

If a negative offset is detected, the loader will now print an
informative warning stating that the offset must be non-negative,
and return -EINVAL.

Additionally, free(func) is called in this new error path to prevent
a memory leak, as the function name string is dynamically allocated
by sscanf().

Fixes: e3f9bc35ea7e9 ("libbpf: Allow decimal offset for kprobes")
Acked-by: Mykyta Yatsenko <yatsenko@meta.com>
Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>
---
Changes in v2 [1]:
 - Corrected subject prefix to target "bpf-next" (Mykyta Yatsenko)
 - Added "Fixes:" tag (Mykyta Yatsenko)
 - Added "Acked-by:" tag from Mykyta Yatsenko

Changes in v1 [2]:
 - Added omitted mailing list entries

[1]: https://lore.kernel.org/lkml/20260417195816.1265179-1-atomlin@atomlin.com/
[2]: https://lore.kernel.org/bpf/0a8afc43-dfd8-4aa0-ae94-a82f8c307599@gmail.com/T/#t

 tools/lib/bpf/libbpf.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 8b0c3246097f..af81e0e200b9 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -12279,7 +12279,7 @@ bpf_program__attach_kprobe_multi_opts(const struct bpf_program *prog,
 static int attach_kprobe(const struct bpf_program *prog, long cookie, struct bpf_link **link)
 {
 	DECLARE_LIBBPF_OPTS(bpf_kprobe_opts, opts);
-	unsigned long offset = 0;
+	long offset = 0;
 	const char *func_name;
 	char *func;
 	int n;
@@ -12301,6 +12301,13 @@ static int attach_kprobe(const struct bpf_program *prog, long cookie, struct bpf
 		pr_warn("kprobe name is invalid: %s\n", func_name);
 		return -EINVAL;
 	}
+
+	if (offset < 0) {
+		free(func);
+		pr_warn("kprobe offset must be a non-negative integer: %li\n", offset);
+		return -EINVAL;
+	}
+
 	if (opts.retprobe && offset != 0) {
 		free(func);
 		pr_warn("kretprobes do not support offset specification\n");
-- 
2.51.0

Re: [PATCH bpf-next v3] libbpf: Report error when a negative kprobe offset is specified

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf-next.git (master)
by Kumar Kartikeya Dwivedi <memxor@gmail.com>:

On Sat, 18 Apr 2026 23:09:44 -0400 you wrote:
> In attach_kprobe(), the parsing logic uses sscanf() to extract the
> target function name and offset from the section definition. Currently,
> if a user specifies a negative offset (e.g., SEC("kprobe/func+-100")),
> the input is not explicitly caught and reported as an error.
> 
> This commit updates the logic to explicitly notify the user when a
> negative integer is provided. To facilitate this check, the offset
> variable is changed from unsigned long to long so that sscanf()
> can accurately capture a negative input for evaluation.
> 
> [...]

Here is the summary with links:
  - [bpf-next,v3] libbpf: Report error when a negative kprobe offset is specified
    https://git.kernel.org/bpf/bpf-next/c/ad35d8018669

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html