On Tue, Jul 14, 2026 at 02:38:46AM -0700, Sun Jian wrote:
> Add verifier coverage for constant negative offsets on PTR_TO_TP_BUFFER
> and PTR_TO_BUF pointers. Both programs adjust the buffer pointer by -8
> and access it at offset zero, so the negative effective start must be
> rejected at load time.
[...]
> + const struct bpf_insn negative_var_off_program[] = {
> + BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
> + /* make var_off negative, but keep the effective access offset
> non-negative */
> + BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
> + /* one byte beyond the end of the writable context */
> + BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_6,
> + sizeof(struct bpf_testmod_test_writable_ctx) + 8),
> + BPF_EXIT_INSN(),
> + };
Come to think of it, perhaps we can add another one that test one byte
*before* the start of the writable context?
I understand that it won't even reach the attachment phase because after
your 1st patch is applied, access to effective negative offset of will
be rejected at load time, but the one that tried to access one byte
before the start of writable context was what that triggered KASAN, and
would be useful to have it as a regression test.
Or alternatively simply change negative_var_off_program[] to be the one
that test access *before* the start of context. I am not even sure if
the compiler generate such pattern; if it doesn't, then this test would
make future refactoring harder without much benefit.
[...]
