From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f54.google.com (mail-wr1-f54.google.com [209.85.221.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D85253E5570 for ; Fri, 10 Jul 2026 08:11:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.54 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783671067; cv=none; b=dOtfHX9teaev7sOPWaZDFIKEDv80kMz7Dpd96LJsH1uZgFnLEKJxiqXodKYE/1c+2sD2KFDFaiw6nAun0za00o7XMcJMGZf47FJP7hD0ZQRpyaXMfgti6JochTnBdKFusURciELGtbp+UQROzmH9w3uHrolugqKlCEVYrnnPj/U= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783671067; c=relaxed/simple; bh=fxlcw6288+e8imbR4cGoArS+B9rHJ1GDKL4sRRdcSqs=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=qYPnEkCgMhKV29qnJ3jglZLutnuOiLqmL9q3cK1AkDHV4Vi+YIK1sss/X3JB0DMbpLY3P9gyu6AKAZMx+7K3yp0kridcyd1WtXgCjjfac6iWfkWp3qYryrw9oeovB6Bm5oNZzQgYZuXSaLjbQ4IA/HqrLeZBAsiK1YeYVMiql30= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=suse.com; spf=pass smtp.mailfrom=suse.com; dkim=pass (2048-bit key) header.d=suse.com header.i=@suse.com header.b=GpSy9iW0; arc=none smtp.client-ip=209.85.221.54 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=suse.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=suse.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=suse.com header.i=@suse.com header.b="GpSy9iW0" Received: by mail-wr1-f54.google.com with SMTP id ffacd0b85a97d-470174001a0so432035f8f.0 for ; Fri, 10 Jul 2026 01:11:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=google; t=1783671064; x=1784275864; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=bmNLcYZ7DY0jmVRO7inGJQa9CXuBgSwFuE+h0UJtvU4=; b=GpSy9iW0x/W7Df8CzpzCRW/RkF5pi7LXHWWjWMN5gJ80Vu2EsWe05DYDPEgI8e5PFF FDCUfkLLmnu0sAIYtQMDaBEvLOzvKiNBCL4aq3VqWw/6puYuNwRfQX7PhK9krEQ5spCZ 6UpmxgUmFa6IFqYDxH/ay4lNY9vkTbxSpjqbtkZgrluwMx7WqHMihrDGt1X5VRkoJRzX N0oeBD7jwapOlCl3xQ6ShTzBrfiidXN79CATzqqcx6Cw4tHVRBm/o4EmyPnYwfk7CSTG m9ikJTZPOCZKwcm/HNke27BvP7T/ZkUZz/gEEdaEuWgCqsiC3jnYnKY5dyoZqPqcA/yz Z8bQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783671064; x=1784275864; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=bmNLcYZ7DY0jmVRO7inGJQa9CXuBgSwFuE+h0UJtvU4=; b=G5s/sx5+ptIopAy6Klm/1CzYCpqzUClKZuPVzHxYTu2Wrmq7pFVCP4nT9Nd8u0Kkz5 EJPya0ndw1rOIVCyHXVf6beUOW9aR6dVyxMlOk57YBK9GK7VLTvvwxnouKjx7bWey0Sz ih47cfIQKhP8THnyK9eDwxNKzutdywAXYWuo9MtG2OMeXgWdDtTDPNymHVwSVpmOaRez jdyIQfZIiFbdJugvLk5pSyoflMNDlo9+UsuURq0lRqSr1wUgiZv18V9x/D7wKqolZT6o lPL6mY66KFo0sCcuDEFdQv5mZDw6rhpBjcGPCcQccZivvzsxhWRxNuUbVjWziAJ+yber hcdw== X-Forwarded-Encrypted: i=1; AHgh+Rq8/STdFbZyW1HweI+82TbuOZuGVwpMOhTKIDv9LULY05JDYaJwMYRmujPQcqpHZeLvgyF2hF4+n0OJGM4=@vger.kernel.org X-Gm-Message-State: AOJu0Yw1Z604F4fUKnV7YgUoFTbz6JKpk9wr2L7QyHUP7dTiicuq6njr sgD0CXd0xMCB2uTIPDLKFGUmX0Luat/eXY5xPReCcFhCEOw6YcQW3KabXVPgdMZLgFQ= X-Gm-Gg: AfdE7clOoSZiIbDkVSDUGT+FkjUtovAGq+FB8VRmcQqxmnffX6ca6BHOeg4ctuiwDHL NNLajZSyw9vlqx1GxP1bUgsrOfjBM8m+d9In0QXX2SW6lpLVwljMDGA+P8ciL+1+CcSDvNOikzS wqMjXY5nSqTGxAbI+LYL1yrBB544sqUOg7ilvw2XpSZVLu7gia8UfzUgt0RLld/mlistYvR1l7G R52u3Ae36ognkQPhjeLeTwXTGusttvZUM65bSQJ+Oy+HPZ+cxycx0erH+dR50nfIL6jy5U6b8Rc Hj4Lt2xkP8kn7uSyE+tr3yY56QBhIsanD2Q9koCpYbYvGUEorBllZuJ8WXKIBgWEi9aWzOrSbpN zEjdVOCynfGco8ghtTewW5QH0+rkCZP5I+Xcsw/O31RK2uUcAvasFPSDzYBjmyIYNyS0vqRD7kw h9oEiblClVzOEprGDW2+qDqaquTsLQFzuS5sU= X-Received: by 2002:a05:600c:e54a:10b0:492:3754:15f2 with SMTP id 5b1f17b1804b1-493e68d4081mr70813635e9.32.1783671064124; Fri, 10 Jul 2026 01:11:04 -0700 (PDT) Received: from u94a (27-53-185-121.adsl.fetnet.net. [27.53.185.121]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-ca5b3b251eesm4566350a12.31.2026.07.10.01.10.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 10 Jul 2026 01:11:03 -0700 (PDT) Date: Fri, 10 Jul 2026 16:10:54 +0800 From: Shung-Hsi Yu To: sun jian , Eduard Zingerman Cc: bpf@vger.kernel.org, ast@kernel.org, daniel@iogearbox.net, john.fastabend@gmail.com, andrii@kernel.org, memxor@gmail.com, martin.lau@linux.dev, song@kernel.org, yonghong.song@linux.dev, jolsa@kernel.org, emil@etsalapatis.com, shuah@kernel.org, mmullins@fb.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org Subject: Re: [PATCH bpf v4 1/2] bpf: Reject negative const offsets for buffer pointers Message-ID: References: <20260708090151.151729-1-sun.jian.kdev@gmail.com> <20260708090151.151729-2-sun.jian.kdev@gmail.com> <1f8aad47f61fbf85eb55276e4bb01bfcff61393e.camel@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Forgot to include the verifier log when running verifier_raw_tp_writable/raw_tracepoint_writable as evidence. On Fri, Jul 10, 2026 at 04:00:27PM +0800, Shung-Hsi Yu wrote: > So I think I now have a better picture of what's going on. Before > 022ac0750883, negative const offset is rejected at *load* time because > the const offset is accumulated into `off` before the negative check: > > // check_mem_access() > off += reg->off > // __check_buffer_access() > if (off < 0) return return -EACCES; > if (!tnum_is_const(reg->var_off) || reg->var_off.value) return -EACCES; On 136114e0abf0 ("Merge tag 'mm-nonmm-stable-2026-02-12-10-48'...") I get: libbpf: prog 'tracepoint_writable_reject_negative_const_offset': BPF program load failed: -EACCES ... 0: R1=ctx() R10=fp0 ; asm volatile (" \ @ verifier_raw_tp_writable.c:56 0: (79) r6 = *(u64 *)(r1 +0) ; R1=ctx() R6=tp_buffer() 1: (07) r6 += -8 ; R6=tp_buffer(off=-8) 2: (79) r0 = *(u64 *)(r6 +0) R6 invalid tracepoint buffer access: off=-8, size=8 processed 3 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 > After 022ac0750883 the const offset accumulation does not happen, and > thus now negative const offset is no longer rejected at load time. > > // __check_buffer_access() > if (off < 0) return return -EACCES; > if (!tnum_is_const(reg->var_off)) return -EACCES; On a4553044d1af ("Merge branch 'bpf-bound-rdonly-rdwr_buf_size-kfunc-return-size'") I get 0: R1=ctx() R10=fp0 ; asm volatile (" \ @ verifier_raw_tp_writable.c:56 0: (79) r6 = *(u64 *)(r1 +0) ; R1=ctx() R6=tp_buffer() 1: (07) r6 += -8 ; R6=tp_buffer(imm=-8) 2: (79) r0 = *(u64 *)(r6 +0) ; R0=scalar() R6=tp_buffer(imm=-8) 3: (95) exit processed 4 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 > [...]