[PATCH bpf] libbpf: Reject excessive program counts in generated loaders

From: Mahe Tardy

Date: Wed Oct 28 2026 - 14:40:47 EST


An object containing MAX_USED_PROGS+1 (33) programs successfully
produces a light skeleton that laters fails at load time with -EACCES
because saving the 33rd FD emits a store at r10 + 0:

*(u32 *)(r10 +0) = r7
invalid write to stack R10 off=0 size=4

This catches the unsupported count during generation instead of
producing a loader that the verifier rejects later.

Fixes: 67234743736a ("libbpf: Generate loader program out of BPF ELF file.")
Signed-off-by: Mahe Tardy <mahe.tardy@xxxxxxxxx>
---
tools/lib/bpf/gen_loader.c | 5 +++++
1 file changed, 5 insertions(+)

diff --git a/tools/lib/bpf/gen_loader.c b/tools/lib/bpf/gen_loader.c
index 251392aa8b41..80a6b5306183 100644
--- a/tools/lib/bpf/gen_loader.c
+++ b/tools/lib/bpf/gen_loader.c
@@ -122,6 +122,11 @@ void bpf_gen__init(struct bpf_gen *gen, int log_level, int nr_progs, int nr_maps
gen->log_level = log_level;
gen->nr_obj_maps = nr_maps;
gen->max_func_ptr_maps = max_func_ptr_maps;
+ if (nr_progs > MAX_USED_PROGS) {
+ pr_warn("Total programs exceeds %d\n", MAX_USED_PROGS);
+ gen->error = -E2BIG;
+ return;
+ }
if (nr_maps + max_func_ptr_maps > MAX_USED_MAPS) {
pr_warn("Total maps exceeds %d\n", MAX_USED_MAPS);
gen->error = -E2BIG;
--
2.43.0