On Wed, 2026-07-15 at 13:26 +0800, sun jian wrote: [...]
> > Anyway, still recommend adding a regression test that test access to one > > byte before the start of writable context. > > > > The new tracepoint_writable_reject_negative_const_offset verifier case > already covers an access before the start of the writable context: > > r6 = *(u64 *)(r1 + 0); > r6 += -8; > r0 = *(u64 *)(r6 + 0); > > Its effective access range is [-8, 0), so it is rejected at load time. > This is the direct regression test for the negative-start case. The existing test seem to be sufficient, why would it matter is at offset -8 or -1 given that the read is appropriately sized? The added test in tools/testing/selftests/bpf/progs/verifier_raw_tp_writable.c is redundant given the changes in raw_tp_writable_reject_bad_access.c but I was going to apply anyway.
