microsoft / microsoft/ebpf-for-windows

bpf(): BPF_PROG_LOAD verifier log has different semantics than Linux

Open
#4,378 0 comments 0 reactions 1 assignee Assigned to @mikeagun View on GitHub
bug P2 triaged
Dominant language
C
Stars
3.6k
Forks
311
Avg merge
6d 10h
Merged PRs (30d)
21

Description

### Describe the bug

On Linux the verifier log works as follows:
* The log can be requested for failing program loads _and successful ones_. This is because it's sometimes useful to see how the verifier analysed a valid program.
* It is also possible to control the verbosity of the log via flags.
* Trying to load a program with an undersized buffer for the verifier log results in ENOSPC. This is important because it allows ebpf-go to resize the buffer and try again.

We currently don't implement this behavior, which causes compatibility problems.

### OS information

_No response_

### Steps taken to reproduce bug

Invoke BPF_PROG_LOAD via bpf() with the log_buf fields set.

### Expected behavior

- A small buffer should be rejected with ENOSPC.
- Log_level should be useable.

### Actual outcome

- No ENOSPC.
- Log_level has no effect.

### Additional details

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.