On Wed, Jul 15, 2026 at 12:23 PM Shung-Hsi Yu <[email protected]> wrote:
>
> On Wed, Jul 15, 2026 at 12:15:07PM +0800, Shung-Hsi Yu wrote:
> > On Tue, Jul 14, 2026 at 02:38:46AM -0700, Sun Jian wrote:
> > > Add verifier coverage for constant negative offsets on PTR_TO_TP_BUFFER
> > > and PTR_TO_BUF pointers. Both programs adjust the buffer pointer by -8
> > > and access it at offset zero, so the negative effective start must be
> > > rejected at load time.
> > [...]
> > > + const struct bpf_insn negative_var_off_program[] = {
> > > + BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
> > > + /* make var_off negative, but keep the effective access
> > > offset non-negative */
> > > + BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
> > > + /* one byte beyond the end of the writable context */
> > > + BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_6,
> > > + sizeof(struct bpf_testmod_test_writable_ctx) + 8),
> > > + BPF_EXIT_INSN(),
> > > + };
> >
> > Come to think of it, perhaps we can add another one that test one byte
> > *before* the start of the writable context?
> >
> > I understand that it won't even reach the attachment phase because after
> > your 1st patch is applied, access to effective negative offset of will
> > be rejected at load time, but the one that tried to access one byte
> > before the start of writable context was what that triggered KASAN, and
> > would be useful to have it as a regression test.
>
> I really should proof-read more before I send...
>
> Since the "effective access offset non-negative" should be rejected, it
> would not make refactoring harder, sorry. What I said below in the last
> email is wrong.
>
> Anyway, still recommend adding a regression test that test access to one
> byte before the start of writable context.
>
The new tracepoint_writable_reject_negative_const_offset verifier case
already covers an access before the start of the writable context:
r6 = *(u64 *)(r1 + 0);
r6 += -8;
r0 = *(u64 *)(r6 + 0);
Its effective access range is [-8, 0), so it is rejected at load time.
This is the direct regression test for the negative-start case.
> > Or alternatively simply change negative_var_off_program[] to be the one
> > that test access *before* the start of context. I am not even sure if
> > the compiler generate such pattern; if it doesn't, then this test would
> > make future refactoring harder without much benefit.
> >
> > [...]
