Re: [PATCH bpf v5 2/2] selftests/bpf: Cover negative buffer pointer offsets

[Shung-Hsi Yu <shung-hsi.yu@suse.com>]

On Wed, Jul 15, 2026 at 12:15:07PM +0800, Shung-Hsi Yu wrote:
> On Tue, Jul 14, 2026 at 02:38:46AM -0700, Sun Jian wrote:
> > Add verifier coverage for constant negative offsets on PTR_TO_TP_BUFFER
> > and PTR_TO_BUF pointers. Both programs adjust the buffer pointer by -8
> > and access it at offset zero, so the negative effective start must be
> > rejected at load time.
> [...]
> > +	const struct bpf_insn negative_var_off_program[] = {
> > +		BPF_LDX_MEM(BPF_DW, BPF_REG_6, BPF_REG_1, 0),
> > +		/* make var_off negative, but keep the effective access offset non-negative */
> > +		BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, -8),
> > +		/* one byte beyond the end of the writable context */
> > +		BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_6,
> > +			    sizeof(struct bpf_testmod_test_writable_ctx) + 8),
> > +		BPF_EXIT_INSN(),
> > +	};
> 
> Come to think of it, perhaps we can add another one that test one byte
> *before* the start of the writable context?
> 
> I understand that it won't even reach the attachment phase because after
> your 1st patch is applied, access to effective negative offset of will
> be rejected at load time, but the one that tried to access one byte
> before the start of writable context was what that triggered KASAN, and
> would be useful to have it as a regression test.

I really should proof-read more before I send... 

Since the "effective access offset non-negative" should be rejected, it
would not make refactoring harder, sorry. What I said below in the last
email is wrong.

Anyway, still recommend adding a regression test that test access to one
byte before the start of writable context.

> Or alternatively simply change negative_var_off_program[] to be the one
> that test access *before* the start of context. I am not even sure if
> the compiler generate such pattern; if it doesn't, then this test would
> make future refactoring harder without much benefit.
> 
> [...]