Reject negative effective offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF buffer accesses, and add raw tracepoint writable coverage for both load-time rejection and the attach-time max_tp_access path.
--- Changes in v4: - Correct the Fixes tag to point to 022ac0750883, where pointer offsets were folded into reg->var_off. - Drop the end > U32_MAX check, which is unreachable after bounding const var_off with BPF_MAX_VAR_OFF while keeping instruction offsets and access sizes bounded. Changes in v3: - Check constant var_off against +/-BPF_MAX_VAR_OFF before computing the effective access range, matching the existing verifier pointer offset convention. - Keep explicit rejection of negative instruction offsets and keep bounded negative constant var_off valid when the effective offset is non-negative. Changes in v2: - Split the kernel fix and selftests into separate patches. - Add an attach-time raw tracepoint writable test that exercises max_tp_access against nbd_send_request's writable size. - Adjust selftest formatting to use the 100 character line width. Tested: - ./test_progs -t verifier_raw_tp_writable - ./test_progs -t raw_tp_writable_reject_nbd_invalid -v - ./test_progs -t raw_tp_writable_test_run v3: https://lore.kernel.org/bpf/[email protected]/ v2: https://lore.kernel.org/bpf/[email protected]/ v1: https://lore.kernel.org/bpf/[email protected]/ Sun Jian (2): bpf: Reject negative const offsets for buffer pointers selftests/bpf: Cover negative raw_tp writable buffer offsets kernel/bpf/verifier.c | 40 +++++++++++-- .../raw_tp_writable_reject_nbd_invalid.c | 58 +++++++++++-------- .../bpf/progs/verifier_raw_tp_writable.c | 16 +++++ 3 files changed, 85 insertions(+), 29 deletions(-) base-commit: 12091470c6b4c1c14b2de12dcbae2ada6cb6d20b -- 2.43.0
