Re: [PATCH bpf v5 2/2] selftests/bpf: Cover negative buffer pointer offsets

[Shung-Hsi Yu]

On Tue, Jul 14, 2026 at 02:38:46AM -0700, Sun Jian wrote:
> Add verifier coverage for constant negative offsets on PTR_TO_TP_BUFFER
> and PTR_TO_BUF pointers. Both programs adjust the buffer pointer by -8
> and access it at offset zero, so the negative effective start must be
> rejected at load time.
> 
> Switch the raw tracepoint writable attach checks from nbd_send_request
> to bpf_testmod_test_writable_bare_tp, avoiding a dependency on the NBD
> tracepoint. Keep the existing past-end case and add a case with a
> negative var_off compensated by a positive instruction offset. The
> effective start remains non-negative, so the program loads, but its
> access end exceeds the writable context size and
> bpf_raw_tracepoint_open() must return -EINVAL.
> 
> Reported-by: Shung-Hsi Yu <shung-hsi.yu@xxxxxxxx>
> Link: https://lore.kernel.org/bpf/alRtilWhKw4zzMkI@u94a
> Cc: stable@xxxxxxxxxxxxxxx # 5.2.0
...

IMO it is slightly better to split this into two. First part would be
[1] suggested by Eduard, and the second part would be the addition of
negative offset test.

That said, I checked that with v5.2 we do have PTR_TO_TP_BUFFER and
PTR_TO_BUF support already (latter as PTR_TO_RDONLY_BUF and
PTR_TO_RDWR_BUF), so there shouldn't be a problem having these tests
back in stable.

Acked-by: Shung-Hsi Yu <shung-hsi.yu@xxxxxxxx>

1: https://lore.kernel.org/bpf/3430dc0a2a141769a596ab21d7abdd86a0a804db.camel@xxxxxxxxx/2-tp-test.diff