Re: [PATCH bpf-next 2/2] selftests/bpf: Add mmap/munmap benchmark for array maps

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Mutating `env.producer_cnt` inside `validate()` causes a heap buffer overflow in the core benchmark runner framework.
--

--- Patch [2]: [PATCH bpf-next 2/2] selftests/bpf: Add mmap/munmap benchmark for array maps ---
commit 39f3ece9fcc36c46f5da11156d115c4340de663c
Author: Song Liu <song@kernel.org>

selftests/bpf: Add mmap/munmap benchmark for array maps

Add a benchmark that repeatedly mmap()s and munmap()s an mmap-able BPF
array map (BPF_F_MMAPABLE) from a configurable number of threads. Both
the number of worker threads and the size of the map are tunable via
--nr-threads and --map-size, defaulting to 16 threads and 8MiB.

> diff --git a/tools/testing/selftests/bpf/benchs/bench_arraymap_mmap.c b/tools/testing/selftests/bpf/benchs/bench_arraymap_mmap.c
> new file mode 100644
> index 0000000000000..356d80a85cf01
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/benchs/bench_arraymap_mmap.c
> @@ -0,0 +1,146 @@
[ ... ]
> +static void validate(void)
> +{
> +	if (env.consumer_cnt != 0) {
> +		fprintf(stderr, "benchmark doesn't support consumer!\n");
> +		exit(1);
> +	}
> +
> +	/*
> +	 * The number of worker threads is controlled by --nr-threads and
> +	 * drives the framework's producer machinery, so per-producer stats
> +	 * are reported correctly.
> +	 */
> +	env.producer_cnt = args.nr_threads;
> +}

[Severity: Medium]
Does mutating env.producer_cnt inside validate() cause a heap buffer overflow?

The state.producers array is allocated in setup_benchmark() based on the
initial env.producer_cnt:

tools/testing/selftests/bpf/bench.c:setup_benchmark() {
    ...
    state.producers = calloc(env.producer_cnt, sizeof(*state.producers));
    ...
}

When this validate callback overwrites env.producer_cnt with args.nr_threads
(which defaults to 16), the core framework later iterates over the new count
when spawning threads:

tools/testing/selftests/bpf/bench.c:setup_benchmark() {
    ...
    for (i = 0; i < env.producer_cnt; i++) {
        ...
        err = pthread_create(&state.producers[i], NULL,
                             bench->producer_thread, (void *)(long)i);
    ...
}

This will write out of bounds since the array was originally sized for the
unmodified env.producer_cnt.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260722065308.4116186-1-song@kernel.org?part=2