On Tue, Jul 14, 2026 at 02:38:46AM -0700, Sun Jian wrote: > Add verifier coverage for constant negative offsets on PTR_TO_TP_BUFFER > and PTR_TO_BUF pointers. Both programs adjust the buffer pointer by -8 > and access it at offset zero, so the negative effective start must be > rejected at load time. > > Switch the raw tracepoint writable attach checks from nbd_send_request > to bpf_testmod_test_writable_bare_tp, avoiding a dependency on the NBD > tracepoint. Keep the existing past-end case and add a case with a > negative var_off compensated by a positive instruction offset. The > effective start remains non-negative, so the program loads, but its > access end exceeds the writable context size and > bpf_raw_tracepoint_open() must return -EINVAL. > > Reported-by: Shung-Hsi Yu <[email protected]> > Link: https://lore.kernel.org/bpf/alRtilWhKw4zzMkI@u94a > Cc: [email protected] # 5.2.0 ...
IMO it is slightly better to split this into two. First part would be [1] suggested by Eduard, and the second part would be the addition of negative offset test. That said, I checked that with v5.2 we do have PTR_TO_TP_BUFFER and PTR_TO_BUF support already (latter as PTR_TO_RDONLY_BUF and PTR_TO_RDWR_BUF), so there shouldn't be a problem having these tests back in stable. Acked-by: Shung-Hsi Yu <[email protected]> 1: https://lore.kernel.org/bpf/[email protected]/2-tp-test.diff
