Re: [PATCH bpf] bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir

[Christian Brauner]

On Thu, Sep 24, 2026 at 02:20:54AM +0000, Alexei Starovoitov wrote:
> On Tue Sep 22, 2026 at 2:55 PM UTC, Andrea Parri wrote:
> > bpf_lsm_has_d_inode_locked() makes the verifier rewrite
> > bpf_[set|remove]_dentry_xattr() to the _locked variants, which assume
> > that the caller already holds the inode's i_rwsem.  The path_unlink and
> > path_rmdir hooks are listed, but security_path_unlink() and
> > security_path_rmdir() run before vfs_unlink()/vfs_rmdir() take the
> > victim inode's i_rwsem, so a sleepable BPF LSM program attached to
> > either hook mutates the victim's xattrs without the lock held.
> >
> > Drop the two path hooks from d_inode_locked_hooks so that the verifier
> > keeps the locking bpf_[set|remove]_dentry_xattr() variants, which take
> > the lock themselves.
> >
> > Fixes: 56467292794b8 ("bpf: fs/xattr: Add BPF kfuncs to set and remove xattrs")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Assisted-by: LLM
> > Signed-off-by: Andrea Parri <parri.andrea@xxxxxxxxx>
> > ---
> >  fs/bpf_fs_kfuncs.c | 4 ----
> >  1 file changed, 4 deletions(-)
> >
> > diff --git a/fs/bpf_fs_kfuncs.c b/fs/bpf_fs_kfuncs.c
> > index 6cb8772679782..357a379ef92a5 100644
> > --- a/fs/bpf_fs_kfuncs.c
> > +++ b/fs/bpf_fs_kfuncs.c
> > @@ -472,10 +472,6 @@ BTF_ID(func, bpf_lsm_inode_rmdir)
> >  BTF_ID(func, bpf_lsm_inode_setattr)
> >  BTF_ID(func, bpf_lsm_inode_setxattr)
> >  BTF_ID(func, bpf_lsm_inode_unlink)
> > -#ifdef CONFIG_SECURITY_PATH
> > -BTF_ID(func, bpf_lsm_path_unlink)
> > -BTF_ID(func, bpf_lsm_path_rmdir)
> > -#endif /* CONFIG_SECURITY_PATH */
> >  BTF_SET_END(d_inode_locked_hooks)
> 
> Christian,
> this looks correct. Want to take it via vfs?

Yes, picked up now. Sorry, foot injury was afk.