bpf: allow invoking bpf_for_each_map_elem with different maps

Taking different maps within a single bpf_for_each_map_elem call is not
allowed before, because from the second map,
bpf_insn_aux_data->map_ptr_state will be marked as *poison*. In fact
both map_ptr and state are needed to support this use case: map_ptr is
used by set_map_elem_callback_state() while poison state is needed to
determine whether to use direct call.

Signed-off-by: Philo Lu <lulie@linux.alibaba.com>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Link: https://lore.kernel.org/r/20240405025536.18113-3-lulie@linux.alibaba.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 62fedb1f331273b1a11ef4b55fd0eda0fed26966..590db4e4c071cd3c32956811394ac4f606d0b110 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -9651,11 +9651,7 @@ static int set_map_elem_callback_state(struct bpf_verifier_env *env,
        struct bpf_map *map;
        int err;
 
-       if (bpf_map_ptr_poisoned(insn_aux)) {
-               verbose(env, "tail_call abusing map_ptr\n");
-               return -EINVAL;
-       }
-
+       /* valid map_ptr and poison value does not matter */
        map = insn_aux->map_ptr_state.map_ptr;
        if (!map->ops->map_set_for_each_callback_args ||
            !map->ops->map_for_each_callback) {