Hi Greg, Please consider cherry-pick this patch series into 5.16.x stable. It includes a fix to a bug in 5.16 stable which allows a user with cap_bpf privileges to get root privileges. The patch that fixes the bug is patch 7/9: bpf: Make per_cpu_ptr return rdonly The rest are the depedences required by the fix patch. This patchset has been merged in mainline v5.17. The patches were not planned to backport because of its complex dependences. Tested by compile, build and run through a subset of bpf test_progs. Hao Luo (9): bpf: Introduce composable reg, ret and arg types. bpf: Replace ARG_XXX_OR_NULL with ARG_XXX | PTR_MAYBE_NULL bpf: Replace RET_XXX_OR_NULL with RET_XXX | PTR_MAYBE_NULL bpf: Replace PTR_TO_XXX_OR_NULL with PTR_TO_XXX | PTR_MAYBE_NULL bpf: Introduce MEM_RDONLY flag bpf: Convert PTR_TO_MEM_OR_NULL to composable types. bpf: Make per_cpu_ptr return rdonly PTR_TO_MEM. bpf: Add MEM_RDONLY for helper args that are pointers to rdonly mem. bpf/selftests: Test PTR_TO_RDONLY_MEM include/linux/bpf.h | 101 +++- include/linux/bpf_verifier.h | 17 + kernel/bpf/btf.c | 12 +- kernel/bpf/cgroup.c | 2 +- kernel/bpf/helpers.c | 12 +- kernel/bpf/map_iter.c | 4 +- kernel/bpf/ringbuf.c | 2 +- kernel/bpf/syscall.c | 2 +- kernel/bpf/verifier.c | 488 +++++++++--------- kernel/trace/bpf_trace.c | 26 +- net/core/bpf_sk_storage.c | 2 +- net/core/filter.c | 64 +-- net/core/sock_map.c | 2 +- .../selftests/bpf/prog_tests/ksyms_btf.c | 14 + .../bpf/progs/test_ksyms_btf_write_check.c | 29 ++ 15 files changed, 444 insertions(+), 333 deletions(-) create mode 100644 tools/testing/selftests/bpf/progs/test_ksyms_btf_write_check.c -- 2.35.1.265.g69c8d7142f-goog
