Forgot to include the verifier log when running
verifier_raw_tp_writable/raw_tracepoint_writable as evidence.
On Fri, Jul 10, 2026 at 04:00:27PM +0800, Shung-Hsi Yu wrote:
> So I think I now have a better picture of what's going on. Before
> 022ac0750883, negative const offset is rejected at *load* time because
> the const offset is accumulated into `off` before the negative check:
>
> // check_mem_access()
> off += reg->off
> // __check_buffer_access()
> if (off < 0) return return -EACCES;
> if (!tnum_is_const(reg->var_off) || reg->var_off.value) return -EACCES;
On 136114e0abf0 ("Merge tag 'mm-nonmm-stable-2026-02-12-10-48'...") I
get:
libbpf: prog 'tracepoint_writable_reject_negative_const_offset': BPF program
load failed: -EACCES
...
0: R1=ctx() R10=fp0
; asm volatile (" \ @
verifier_raw_tp_writable.c:56
0: (79) r6 = *(u64 *)(r1 +0) ; R1=ctx() R6=tp_buffer()
1: (07) r6 += -8 ; R6=tp_buffer(off=-8)
2: (79) r0 = *(u64 *)(r6 +0)
R6 invalid tracepoint buffer access: off=-8, size=8
processed 3 insns (limit 1000000) max_states_per_insn 0 total_states 0
peak_states 0 mark_read 0
> After 022ac0750883 the const offset accumulation does not happen, and
> thus now negative const offset is no longer rejected at load time.
>
> // __check_buffer_access()
> if (off < 0) return return -EACCES;
> if (!tnum_is_const(reg->var_off)) return -EACCES;
On a4553044d1af ("Merge branch
'bpf-bound-rdonly-rdwr_buf_size-kfunc-return-size'") I get
0: R1=ctx() R10=fp0
; asm volatile (" \ @
verifier_raw_tp_writable.c:56
0: (79) r6 = *(u64 *)(r1 +0) ; R1=ctx() R6=tp_buffer()
1: (07) r6 += -8 ; R6=tp_buffer(imm=-8)
2: (79) r0 = *(u64 *)(r6 +0) ; R0=scalar() R6=tp_buffer(imm=-8)
3: (95) exit
processed 4 insns (limit 1000000) max_states_per_insn 0 total_states 0
peak_states 0 mark_read 0
> [...]
