41-xdp-tcpdump/xdp-tcpdump.bpf.c invalid access to packet

[fanrong1992]

$ uname -a
Linux fanrong 6.8.0-48-generic #48~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Mon Oct  7 11:24:13 UTC 2 x86_64 x86_64 x86_64 GNU/Linux
$ sudo ./xdp-tcpdump eno1
...
38: (85) call bpf_ringbuf_reserve#131         ; R0=ringbuf_mem_or_null(id=3,ref_obj_id=3,sz=32) refs=3
; if (!ringbuf_space) {
39: (15) if r0 == 0x0 goto pc+19      ; R0=ringbuf_mem(ref_obj_id=3,sz=32) refs=3
; for (int i = 0; i < tcp_header_bytes; i++) {
40: (0f) r6 += r7                     ; R6_w=pkt(id=4,r=0,smin=umin=smin32=umin32=20,smax=umax=smax32=umax32=60,var_off=(0x0; 0x3c)) R7=scalar(smin=umin=smin32=umin32=20,smax=umax=smax32=umax32=60,var_off=(0x0; 0x3c)) refs=3
41: (07) r6 += 14                     ; R6_w=pkt(id=4,off=14,r=0,smin=umin=smin32=umin32=20,smax=umax=smax32=umax32=60,var_off=(0x0; 0x3c)) refs=3
; ((unsigned char *)ringbuf_space)[i] = byte;
42: (bf) r1 = r0                      ; R0=ringbuf_mem(ref_obj_id=3,sz=32) R1_w=ringbuf_mem(ref_obj_id=3,sz=32) refs=3
43: (0f) r1 += r8                     ; R1_w=ringbuf_mem(ref_obj_id=3,sz=32) R8=0 refs=3
; unsigned char byte = *((unsigned char *)tcp + i);
44: (bf) r2 = r6                      ; R2_w=pkt(id=4,off=14,r=0,smin=umin=smin32=umin32=20,smax=umax=smax32=umax32=60,var_off=(0x0; 0x3c)) R6_w=pkt(id=4,off=14,r=0,smin=umin=smin32=umin32=20,smax=umax=smax32=umax32=60,var_off=(0x0; 0x3c)) refs=3
45: (0f) r2 += r8                     ; R2_w=pkt(id=4,off=14,r=0,smin=umin=smin32=umin32=20,smax=umax=smax32=umax32=60,var_off=(0x0; 0x3c)) R8=0 refs=3
46: (71) r2 = *(u8 *)(r2 +0)
invalid access to packet, off=14 size=1, R2(id=4,off=14,r=0)
R2 offset is outside of the packet
processed 46 insns (limit 1000000) max_states_per_insn 0 total_states 4 peak_states 4 mark_read 2
-- END PROG LOAD LOG --
libbpf: prog 'xdp_pass': failed to load: -13
libbpf: failed to load object 'xdp_tcpdump_bpf'
libbpf: failed to load BPF skeleton 'xdp_tcpdump_bpf': -13
Failed to load and verify BPF skeleton: -13

I run 41 xdp example on my Ubuntu, but it report this error. I don't know why the ebpf verifier complain this, I think the bound check has no problem. Could you please help me solve the problem? Thanks~