Re: [PATCH bpf-next 2/3] bpf: allow invoking bpf_for_each_map_elem with different maps

[Yonghong Song <yonghong.song@linux.dev>]

On 4/1/24 11:16 PM, Philo Lu wrote:
> Taking different maps within a single bpf_for_each_map_elem call is not
> allowed before, because from the second map,
> bpf_insn_aux_data->map_ptr_state will be marked as *poison*. In fact
> both map_ptr and state are needed to support this use case: map_ptr is
> used by set_map_elem_callback_state() while poison state is needed to
> determine whether to use direct call.
>
> Signed-off-by: Philo Lu <lulie@linux.alibaba.com>
> ---
>   kernel/bpf/verifier.c | 6 +-----
>   1 file changed, 1 insertion(+), 5 deletions(-)
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 515ac6165ab1..f0a33f7c2604 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -9649,11 +9649,7 @@ static int set_map_elem_callback_state(struct bpf_verifier_env *env,
>   	struct bpf_map *map;
>   	int err;
>   
> -	if (bpf_map_ptr_poisoned(insn_aux)) {
> -		verbose(env, "tail_call abusing map_ptr\n");
> -		return -EINVAL;
> -	}
> -
> +	/* should not check poison */

Maybe change comments to below?
	/* valid map_ptr and poison value does not matter */

>   	map = insn_aux->map_ptr_state.map_ptr;
>   	if (!map->ops->map_set_for_each_callback_args ||
>   	    !map->ops->map_for_each_callback) {