On 12/2/26 06:10, Andrii Nakryiko wrote:

On Wed, Feb 11, 2026 at 7:13 AM Leon Hwang [off-list ref] wrote:

quoted

[...]

quoted

@@ -6241,7 +6244,11 @@ static int __sys_bpf(enum bpf_cmd cmd, bpfptr_t uattr, unsigned int size,
                err = map_freeze(&attr);
                break;
        case BPF_PROG_LOAD:
-               err = bpf_prog_load(&attr, uattr, size);
+               if (from_user && size >= offsetofend(union bpf_attr, log_true_size))
+                       log_true_size = uattr.user + offsetof(union bpf_attr, log_true_size);

LGTM, so

Acked-by: Andrii Nakryiko <andrii@kernel.org>

Thanks for the review and the Ack!

but it caught my eye that we will never return log_true_size if
SYSCALL program tried to load another BPF program (light skeleton
case), which seems limiting, but we can perhaps address that
separately as a follow up

Correct.

Currently, struct bpf_verifier_log and the log_true_size
back-propagation mechanism are designed specifically for user space and
are not compatible with in-kernel callers.

I’ll look into whether this can be improved in a follow-up.

Thanks,
Leon

[...]