Re: [PATCH bpf-next 3/4] bpf: Keep untrusted PTR_TO_MEM read-only on RCU invalidation

>     bpf: Keep untrusted PTR_TO_MEM read-only on RCU invalidation
>
>     invalidate_rcu_protected_refs() turns MEM_RCU pointers into PTR_UNTRUSTED
>     ones once the RCU read-side critical section ends.
>
>     For a PTR_TO_BTF_ID base that is fine, but for a PTR_TO_MEM base the
>     result has to carry MEM_RDONLY as well, since the rest of the verifier
>     relies on the two coming as a pair (e.g. bpf_convert_ctx_accesses()).
>
>     A writable untrusted PTR_TO_MEM would otherwise end up as a plain load
>     or store to memory without fault protection. No in-tree kfunc produces
>     the combination today, thus this is mainly hardening.
>
>     Signed-off-by: Daniel Borkmann <[email protected]>

This looks like a bug fix that closes a security hole.  Should this include:

  Fixes: 5861d1e8dbc4 ("bpf: Allow bpf_spin_{lock,unlock} in sleepable progs")


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/31743446421