eBPF can't count?!

This post details a critical bug discovered in the eBPF verifier related to 64-bit arithmetic operations (subtraction) when run by unprivileged users. It explains how a security mitigation for Spectre variant 1 attacks inadvertently broke this functionality, leading to incorrect calculations. The post demonstrates the bug, explains the underlying cause by examining kernel code and eBPF bytecode, and discusses workarounds like using 32-bit ALU operations or waiting for kernel patches. This contributes to the understanding of how Cloudflare leverages and debugs low-level kernel technologies for its infrastructure.