bpf: Undo ptr_to_map_key alu sanitation for now

bpf: Undo ptr_to_map_key alu sanitation for now

Remove PTR_TO_MAP_KEY for the time being from being sanitized on pointer ALU
through sanitize_ptr_alu() mainly for 3 reasons:

  1) It's currently unused and not available from unprivileged. However that by
     itself is not yet a strong reason to drop the code.

  2) Commit 359bfbf9bf1e ("bpf: Add bpf_for_each_map_elem() helper") implemented
     the sanitation not fully correct in that unlike stack or map_value pointer
     it doesn't probe whether the access to the map key /after/ the simulated ALU
     operation is still in bounds. This means that the generated mask can truncate
     the offset in the non-speculative domain whereas it should only truncate in
     the speculative domain. The verifier should instead reject such program as
     we do for other types.

  3) Given the recent fixes from 7e6295643e04 ("bpf: Prohibit alu ops for pointer
     types not defining ptr_limit"), 253ad08e1798 ("bpf: Fix off-by-one for area
     size in creating mask to left"), 9aaf1c37b62a ("bpf: Simplify alu_limit masking
     for pointer arithmetic") as well as f28f2c98fa8e ("bpf: Add sanity check for
     upper ptr_limit") the code changed quite a bit and the merge in 85d94a61b7ed
     broke the PTR_TO_MAP_KEY case due to an incorrect merge conflict.

Remove the relevant pieces for the time being and we can rework the PTR_TO_MAP_KEY
case once everything settles.

Fixes: 85d94a61b7ed ("Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net")
Fixes: 359bfbf9bf1e ("bpf: Add bpf_for_each_map_elem() helper")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>