[PATCH bpf-next 3/5] bpf: Finalize the verifier log after the runtime is selected

From: Qiliang Yuan

Date: Mon Nov 02 2026 - 08:13:57 EST


bpf_check() finalizes the log, which reports its size in log_true_size,
and selects the runtime of the prog after that. For a prog of one
function, selecting the runtime blinds the constants.

Blinding can log "insn %d cannot be patched due to 16-bit range". The
message lands in the buffer, but log_true_size doesn't count it: with a
stats-only log, log_true_size is 219 while the log takes 264 bytes. A
caller that sizes the buffer from log_true_size loses the message.

Finalize the log after __bpf_prog_select_runtime().

Fixes: d9ef13f72711 ("bpf: Pass bpf_verifier_env to JIT")
Reported-by: Alexei Starovoitov <ast@xxxxxxxxxx>
Closes: https://lore.kernel.org/bpf/DMKHZS5B5CNO.186F6YH1T6YU4@xxxxxxxxx/
Signed-off-by: Qiliang Yuan <odys.yuan@xxxxxxxxx>
---
kernel/bpf/verifier.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 935b163f81e4b..974dc571eff05 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -24112,11 +24112,6 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, bpfptr_t uattr,
print_verification_stats(env);
env->prog->aux->verified_insns = env->insn_processed;

- /* preserve original error even if log finalization is successful */
- err = bpf_log_attr_finalize(attr_log, &env->log);
- if (err)
- ret = err;
-
if (ret)
goto err_release_maps;

@@ -24167,6 +24162,14 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, bpfptr_t uattr,
env->prog = __bpf_prog_select_runtime(env, env->prog, &ret);

err_release_maps:
+ /*
+ * Finalize the log after the runtime is selected, which blinds the
+ * constants of a prog of one function and can log an error. Preserve
+ * the original error even if log finalization is successful.
+ */
+ err = bpf_log_attr_finalize(attr_log, &env->log);
+ if (err)
+ ret = err;
if (ret)
release_insn_arrays(env);
if (!env->prog->aux->used_maps)

--
2.43.0