libbpf: Report error when a negative kprobe offset is specified

In attach_kprobe(), the parsing logic uses sscanf() to extract the
target function name and offset from the section definition. Currently,
if a user specifies a negative offset (e.g., SEC("kprobe/func+-100")),
the input is not explicitly caught and reported as an error.

This commit updates the logic to explicitly notify the user when a
negative integer is provided. To facilitate this check, the offset
variable is changed from unsigned long to long so that sscanf()
can accurately capture a negative input for evaluation.

If a negative offset is detected, the loader will now print an
informative warning stating that the offset must be non-negative,
and return -EINVAL.

Additionally, free(func) is called in this new error path to prevent
a memory leak, as the function name string is dynamically allocated
by sscanf().

Fixes: e3f9bc35ea7e9 ("libbpf: Allow decimal offset for kprobes")
Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>
Acked-by: Mykyta Yatsenko <yatsenko@meta.com>
Link: https://lore.kernel.org/bpf/20260419030944.1423642-1-atomlin@atomlin.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index 3a80a018fc7d50cb613c62e6b9423739a2794150..83aae7a39d36def2eefee36f0c6e12a3bec03748 100644 (file)
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c
@@ -12280,7 +12280,7 @@ error:
 static int attach_kprobe(const struct bpf_program *prog, long cookie, struct bpf_link **link)
 {
        DECLARE_LIBBPF_OPTS(bpf_kprobe_opts, opts);
-       unsigned long offset = 0;
+       long offset = 0;
        const char *func_name;
        char *func;
        int n;
@@ -12302,6 +12302,13 @@ static int attach_kprobe(const struct bpf_program *prog, long cookie, struct bpf
                pr_warn("kprobe name is invalid: %s\n", func_name);
                return -EINVAL;
        }
+
+       if (offset < 0) {
+               free(func);
+               pr_warn("kprobe offset must be a non-negative integer: %li\n", offset);
+               return -EINVAL;
+       }
+
        if (opts.retprobe && offset != 0) {
                free(func);
                pr_warn("kretprobes do not support offset specification\n");