Repository navigation
41-xdp-tcpdump/xdp-tcpdump.bpf.c invalid access to packet #158
Description
$ uname -a
Linux fanrong 6.8.0-48-generic #48~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Mon Oct 7 11:24:13 UTC 2 x86_64 x86_64 x86_64 GNU/Linux
$ sudo ./xdp-tcpdump eno1
...
38: (85) call bpf_ringbuf_reserve#131 ; R0=ringbuf_mem_or_null(id=3,ref_obj_id=3,sz=32) refs=3
; if (!ringbuf_space) {
39: (15) if r0 == 0x0 goto pc+19 ; R0=ringbuf_mem(ref_obj_id=3,sz=32) refs=3
; for (int i = 0; i < tcp_header_bytes; i++) {
40: (0f) r6 += r7 ; R6_w=pkt(id=4,r=0,smin=umin=smin32=umin32=20,smax=umax=smax32=umax32=60,var_off=(0x0; 0x3c)) R7=scalar(smin=umin=smin32=umin32=20,smax=umax=smax32=umax32=60,var_off=(0x0; 0x3c)) refs=3
41: (07) r6 += 14 ; R6_w=pkt(id=4,off=14,r=0,smin=umin=smin32=umin32=20,smax=umax=smax32=umax32=60,var_off=(0x0; 0x3c)) refs=3
; ((unsigned char *)ringbuf_space)[i] = byte;
42: (bf) r1 = r0 ; R0=ringbuf_mem(ref_obj_id=3,sz=32) R1_w=ringbuf_mem(ref_obj_id=3,sz=32) refs=3
43: (0f) r1 += r8 ; R1_w=ringbuf_mem(ref_obj_id=3,sz=32) R8=0 refs=3
; unsigned char byte = *((unsigned char *)tcp + i);
44: (bf) r2 = r6 ; R2_w=pkt(id=4,off=14,r=0,smin=umin=smin32=umin32=20,smax=umax=smax32=umax32=60,var_off=(0x0; 0x3c)) R6_w=pkt(id=4,off=14,r=0,smin=umin=smin32=umin32=20,smax=umax=smax32=umax32=60,var_off=(0x0; 0x3c)) refs=3
45: (0f) r2 += r8 ; R2_w=pkt(id=4,off=14,r=0,smin=umin=smin32=umin32=20,smax=umax=smax32=umax32=60,var_off=(0x0; 0x3c)) R8=0 refs=3
46: (71) r2 = *(u8 *)(r2 +0)
invalid access to packet, off=14 size=1, R2(id=4,off=14,r=0)
R2 offset is outside of the packet
processed 46 insns (limit 1000000) max_states_per_insn 0 total_states 4 peak_states 4 mark_read 2
-- END PROG LOAD LOG --
libbpf: prog 'xdp_pass': failed to load: -13
libbpf: failed to load object 'xdp_tcpdump_bpf'
libbpf: failed to load BPF skeleton 'xdp_tcpdump_bpf': -13
Failed to load and verify BPF skeleton: -13
I run 41 xdp example on my Ubuntu, but it report this error. I don't know why the ebpf verifier complain this, I think the bound check has no problem. Could you please help me solve the problem? Thanks~
Activity
yanyannn commentedon Nov 13, 2025
我也遇到了同样的报错，我求助chatgpt获得了解决方法。
在进入循环前，显式声明边界指针 tcp_end，并让 verifier 能跟踪它的关系。
把内核态中这段代码：
// Reserve space in the ring buffer
void *ringbuf_space = bpf_ringbuf_reserve(&rb, tcp_header_bytes, 0);
if (!ringbuf_space) {
return XDP_PASS; // If reservation fails, skip processing
}
// Copy the TCP header bytes into the ring buffer
// Using a loop to ensure compliance with eBPF verifier
for (int i = 0; i < tcp_header_bytes; i++) {
// Accessing each byte safely within bounds
unsigned char byte = *((unsigned char *)tcp + i);
((unsigned char *)ringbuf_space)[i] = byte;
}
替换为：
// Reserve space in the ring buffer
void *ringbuf_space = bpf_ringbuf_reserve(&rb, tcp_header_bytes, 0);
if (!ringbuf_space) {
return XDP_PASS; // If reservation fails, skip processing
}
// Define end of TCP header for verifier's range check
void *tcp_end = (void *)tcp + tcp_header_bytes;
if (tcp_end > data_end) {
bpf_ringbuf_discard(ringbuf_space, 0);
return XDP_PASS;
}
// Copy TCP header bytes safely
unsigned char *src = (unsigned char *)tcp;
unsigned char *dst = (unsigned char *)ringbuf_space;
#pragma unroll
for (int i = 0; i < 32; i++) {
if (i >= tcp_header_bytes)
break;
dst[i] = src[i];
}
// Submit to ring buffer
bpf_ringbuf_submit(ringbuf_space, 0);
bpf_printk("Captured TCP header (%d bytes)", tcp_header_bytes);
执行make clean
make
再运行试试看。
yunwei37 commentedon Nov 13, 2025
It might be some issues related to the kernel version.