On Wed, Jul 15, 2026 at 12:15:07PM +0800, Shung-Hsi Yu wrote:
> On Tue, Jul 14, 2026 at 02:38:46AM -0700, Sun Jian wrote:
> > Add verifier coverage for constant negative offsets on PTR_TO_TP_BUFFER
> > and PTR_TO_BUF pointers. Both programs adjust the buffer pointer by -8
> > and access it at offset zero, so the negative effective start must be
> > rejected at load time.
> [...]
> > + const struct bpf_insn negative_var_off_program[] = {
> > + BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
> > + /* make var_off negative, but keep the effective access offset
> > non-negative */
> > + BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
> > + /* one byte beyond the end of the writable context */
> > + BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_6,
> > + sizeof(struct bpf_testmod_test_writable_ctx) + 8),
> > + BPF_EXIT_INSN(),
> > + };
>
> Come to think of it, perhaps we can add another one that test one byte
> *before* the start of the writable context?
>
> I understand that it won't even reach the attachment phase because after
> your 1st patch is applied, access to effective negative offset of will
> be rejected at load time, but the one that tried to access one byte
> before the start of writable context was what that triggered KASAN, and
> would be useful to have it as a regression test.
I really should proof-read more before I send...
Since the "effective access offset non-negative" should be rejected, it
would not make refactoring harder, sorry. What I said below in the last
email is wrong.
Anyway, still recommend adding a regression test that test access to one
byte before the start of writable context.
> Or alternatively simply change negative_var_off_program[] to be the one
> that test access *before* the start of context. I am not even sure if
> the compiler generate such pattern; if it doesn't, then this test would
> make future refactoring harder without much benefit.
>
> [...]
