Re: [PATCH bpf-next] selftests/bpf: Fix map_fds buffer overflow in test_verifier

[Yonghong Song <yhs@xxxxxx>]

On 12/20/21 6:04 AM, Ilya Leoshkevich wrote:
> do_test_fixup() accesses map_fds[21], which is out of bounds. Extend
> map_fds array to 22 elements.
>
> Fixes: e60e6962c503 ("selftests/bpf: Add tests for restricted helpers")
> Signed-off-by: Ilya Leoshkevich <iii@xxxxxxxxxxxxx>
> ---
>   tools/testing/selftests/bpf/test_verifier.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
> index b0bd2a1f6d52..76cd903117af 100644
> --- a/tools/testing/selftests/bpf/test_verifier.c
> +++ b/tools/testing/selftests/bpf/test_verifier.c
> @@ -53,7 +53,7 @@
>   #define MAX_INSNS	BPF_MAXINSNS
>   #define MAX_TEST_INSNS	1000000
>   #define MAX_FIXUPS	8
> -#define MAX_NR_MAPS	21
> +#define MAX_NR_MAPS	22

The patch has been fixed by:
  https://lore.kernel.org/bpf/20211214014800.78762-1-memxor@xxxxxxxxx/
and merged into bpf tree. It should circulate back to bpf-next later
when the patch goes from bpf->net->linus->net-next->bpf-next.

>   #define MAX_TEST_RUNS	8
>   #define POINTER_VALUE	0xcafe4all
>   #define TEST_DATA_LEN	64