Currently, taking different maps within a single bpf_for_each_map_elem
call is not allowed. For example the following codes cannot pass the
verifier (with error "tail_call abusing map_ptr"):
```
static void test_by_pid(int pid)
{
if (pid <= 100)
bpf_for_each_map_elem(&map1, map_elem_cb, NULL, 0);
else
bpf_for_each_map_elem(&map2, map_elem_cb, NULL, 0);
}
```
This is because during bpf_for_each_map_elem verifying,
bpf_insn_aux_data->map_ptr_state is expected as map_ptr (instead of poison
state), which is then needed by set_map_elem_callback_state. However, as
there are two different map ptr input, map_ptr_state is marked as
BPF_MAP_PTR_POISON, and thus the second map_ptr would be lost.
BPF_MAP_PTR_POISON is also needed by bpf_for_each_map_elem to skip
retpoline optimization in do_misc_fixups(). Therefore, map_ptr_state and
map_ptr are both needed for bpf_for_each_map_elem.
This patchset solves it by transform bpf_insn_aux_data->map_ptr_state as a
new struct, storing poison/unpriv state and map pointer together without
additional memory overhead. Then bpf_for_each_map_elem works well with
different input maps. It also makes map_ptr_state logic clearer.
A test case is added to selftest, which would fail to load without this
patchset.
Please review, thanks.
Philo Lu (3):
bpf: store both map ptr and state in bpf_insn_aux_data
bpf: allow invoking bpf_for_each_map_elem with different maps
selftests/bpf: add test for bpf_for_each_map_elem() with different
maps
include/linux/bpf_verifier.h | 9 ++-
kernel/bpf/verifier.c | 42 +++++-------
.../selftests/bpf/prog_tests/for_each.c | 67 +++++++++++++++++++
.../selftests/bpf/progs/for_each_multi_maps.c | 49 ++++++++++++++
4 files changed, 141 insertions(+), 26 deletions(-)
create mode 100644 tools/testing/selftests/bpf/progs/for_each_multi_maps.c
--
2.32.0.3.g01195cf9f
