[PATCH bpf] bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir

[PATCH bpf] bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir

[Andrea Parri]

bpf_lsm_has_d_inode_locked() makes the verifier rewrite
bpf_[set|remove]_dentry_xattr() to the _locked variants, which assume
that the caller already holds the inode's i_rwsem.  The path_unlink and
path_rmdir hooks are listed, but security_path_unlink() and
security_path_rmdir() run before vfs_unlink()/vfs_rmdir() take the
victim inode's i_rwsem, so a sleepable BPF LSM program attached to
either hook mutates the victim's xattrs without the lock held.

Drop the two path hooks from d_inode_locked_hooks so that the verifier
keeps the locking bpf_[set|remove]_dentry_xattr() variants, which take
the lock themselves.

Fixes: 56467292794b8 ("bpf: fs/xattr: Add BPF kfuncs to set and remove xattrs")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
---
 fs/bpf_fs_kfuncs.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/fs/bpf_fs_kfuncs.c b/fs/bpf_fs_kfuncs.c
index 6cb8772679782..357a379ef92a5 100644
--- a/fs/bpf_fs_kfuncs.c
+++ b/fs/bpf_fs_kfuncs.c
@@ -472,10 +472,6 @@ BTF_ID(func, bpf_lsm_inode_rmdir)
 BTF_ID(func, bpf_lsm_inode_setattr)
 BTF_ID(func, bpf_lsm_inode_setxattr)
 BTF_ID(func, bpf_lsm_inode_unlink)
-#ifdef CONFIG_SECURITY_PATH
-BTF_ID(func, bpf_lsm_path_unlink)
-BTF_ID(func, bpf_lsm_path_rmdir)
-#endif /* CONFIG_SECURITY_PATH */
 BTF_SET_END(d_inode_locked_hooks)
 
 bool bpf_lsm_has_d_inode_locked(const struct bpf_prog *prog)
-- 
2.53.0

Re: [PATCH bpf] bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir

[Alexei Starovoitov]

On Tue Sep 22, 2026 at 2:55 PM UTC, Andrea Parri wrote:
> bpf_lsm_has_d_inode_locked() makes the verifier rewrite
> bpf_[set|remove]_dentry_xattr() to the _locked variants, which assume
> that the caller already holds the inode's i_rwsem.  The path_unlink and
> path_rmdir hooks are listed, but security_path_unlink() and
> security_path_rmdir() run before vfs_unlink()/vfs_rmdir() take the
> victim inode's i_rwsem, so a sleepable BPF LSM program attached to
> either hook mutates the victim's xattrs without the lock held.
>
> Drop the two path hooks from d_inode_locked_hooks so that the verifier
> keeps the locking bpf_[set|remove]_dentry_xattr() variants, which take
> the lock themselves.
>
> Fixes: 56467292794b8 ("bpf: fs/xattr: Add BPF kfuncs to set and remove xattrs")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
> ---
>  fs/bpf_fs_kfuncs.c | 4 ----
>  1 file changed, 4 deletions(-)
>
> diff --git a/fs/bpf_fs_kfuncs.c b/fs/bpf_fs_kfuncs.c
> index 6cb8772679782..357a379ef92a5 100644
> --- a/fs/bpf_fs_kfuncs.c
> +++ b/fs/bpf_fs_kfuncs.c
> @@ -472,10 +472,6 @@ BTF_ID(func, bpf_lsm_inode_rmdir)
>  BTF_ID(func, bpf_lsm_inode_setattr)
>  BTF_ID(func, bpf_lsm_inode_setxattr)
>  BTF_ID(func, bpf_lsm_inode_unlink)
> -#ifdef CONFIG_SECURITY_PATH
> -BTF_ID(func, bpf_lsm_path_unlink)
> -BTF_ID(func, bpf_lsm_path_rmdir)
> -#endif /* CONFIG_SECURITY_PATH */
>  BTF_SET_END(d_inode_locked_hooks)

Christian,
this looks correct. Want to take it via vfs?

Re: [PATCH bpf] bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir

[Christian Brauner]

On Tue, 22 Sep 2026 16:55:30 +0200, Andrea Parri wrote:
> bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir

Applied to the vfs.fixes branch of the vfs/vfs.git tree.
Patches in the vfs.fixes branch should appear in linux-next soon.

Please report any outstanding bugs that were missed during review in a
new review to the original patch series allowing us to drop it.

It's encouraged to provide Acked-bys and Reviewed-bys even though the
patch has now been applied. If possible patch trailers will be updated.

Note that commit hashes shown below are subject to change due to rebase,
trailer updates or similar. If in doubt, please check the listed branch.

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
branch: vfs.fixes

[1/1] bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir
      https://git.kernel.org/vfs/vfs/c/35d442ed1f86

Re: [PATCH bpf] bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir

[Christian Brauner]

On Thu, Sep 24, 2026 at 02:20:54AM +0000, Alexei Starovoitov wrote:
> On Tue Sep 22, 2026 at 2:55 PM UTC, Andrea Parri wrote:
> > bpf_lsm_has_d_inode_locked() makes the verifier rewrite
> > bpf_[set|remove]_dentry_xattr() to the _locked variants, which assume
> > that the caller already holds the inode's i_rwsem.  The path_unlink and
> > path_rmdir hooks are listed, but security_path_unlink() and
> > security_path_rmdir() run before vfs_unlink()/vfs_rmdir() take the
> > victim inode's i_rwsem, so a sleepable BPF LSM program attached to
> > either hook mutates the victim's xattrs without the lock held.
> >
> > Drop the two path hooks from d_inode_locked_hooks so that the verifier
> > keeps the locking bpf_[set|remove]_dentry_xattr() variants, which take
> > the lock themselves.
> >
> > Fixes: 56467292794b8 ("bpf: fs/xattr: Add BPF kfuncs to set and remove xattrs")
> > Cc: stable@vger.kernel.org
> > Assisted-by: LLM
> > Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
> > ---
> >  fs/bpf_fs_kfuncs.c | 4 ----
> >  1 file changed, 4 deletions(-)
> >
> > diff --git a/fs/bpf_fs_kfuncs.c b/fs/bpf_fs_kfuncs.c
> > index 6cb8772679782..357a379ef92a5 100644
> > --- a/fs/bpf_fs_kfuncs.c
> > +++ b/fs/bpf_fs_kfuncs.c
> > @@ -472,10 +472,6 @@ BTF_ID(func, bpf_lsm_inode_rmdir)
> >  BTF_ID(func, bpf_lsm_inode_setattr)
> >  BTF_ID(func, bpf_lsm_inode_setxattr)
> >  BTF_ID(func, bpf_lsm_inode_unlink)
> > -#ifdef CONFIG_SECURITY_PATH
> > -BTF_ID(func, bpf_lsm_path_unlink)
> > -BTF_ID(func, bpf_lsm_path_rmdir)
> > -#endif /* CONFIG_SECURITY_PATH */
> >  BTF_SET_END(d_inode_locked_hooks)
> 
> Christian,
> this looks correct. Want to take it via vfs?

Yes, picked up now. Sorry, foot injury was afk.