Patch "fs: prepare for adding LSM blob to backing_file" has been added to the 6.12-stable tree

[<gregkh@linuxfoundation.org>]

This is a note to let you know that I've just added the patch titled

    fs: prepare for adding LSM blob to backing_file

to the 6.12-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     fs-prepare-for-adding-lsm-blob-to-backing_file.patch
and it can be found in the queue-6.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


From stable+bounces-243940-greg=kroah.com@vger.kernel.org Tue May  5 02:16:25 2026
From: Sasha Levin <sashal@kernel.org>
Date: Mon,  4 May 2026 20:16:14 -0400
Subject: fs: prepare for adding LSM blob to backing_file
To: stable@vger.kernel.org
Cc: Amir Goldstein <amir73il@gmail.com>, linux-fsdevel@vger.kernel.org, linux-unionfs@vger.kernel.org, linux-erofs@lists.ozlabs.org, Serge Hallyn <serge@hallyn.com>, Paul Moore <paul@paul-moore.com>, Sasha Levin <sashal@kernel.org>
Message-ID: <20260505001614.127730-1-sashal@kernel.org>

From: Amir Goldstein <amir73il@gmail.com>

[ Upstream commit 880bd496ec72a6dcb00cb70c430ef752ba242ae7 ]

In preparation to adding LSM blob to backing_file struct, factor out
helpers init_backing_file() and backing_file_free().

Cc: stable@vger.kernel.org
Cc: linux-fsdevel@vger.kernel.org
Cc: linux-unionfs@vger.kernel.org
Cc: linux-erofs@lists.ozlabs.org
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Reviewed-by: Serge Hallyn <serge@hallyn.com>
[PM: use the term "LSM blob", fix comment style to match file]
Signed-off-by: Paul Moore <paul@paul-moore.com>
[ Used kfree() instead of kmem_cache_free(bfilp_cachep, ff) ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 fs/file_table.c |   22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -60,6 +60,12 @@ struct path *backing_file_user_path(stru
 }
 EXPORT_SYMBOL_GPL(backing_file_user_path);
 
+static inline void backing_file_free(struct backing_file *ff)
+{
+	path_put(&ff->user_path);
+	kfree(ff);
+}
+
 static inline void file_free(struct file *f)
 {
 	security_file_free(f);
@@ -67,8 +73,7 @@ static inline void file_free(struct file
 		percpu_counter_dec(&nr_files);
 	put_cred(f->f_cred);
 	if (unlikely(f->f_mode & FMODE_BACKING)) {
-		path_put(backing_file_user_path(f));
-		kfree(backing_file(f));
+		backing_file_free(backing_file(f));
 	} else {
 		kmem_cache_free(filp_cachep, f);
 	}
@@ -255,6 +260,12 @@ struct file *alloc_empty_file_noaccount(
 	return f;
 }
 
+static int init_backing_file(struct backing_file *ff)
+{
+	memset(&ff->user_path, 0, sizeof(ff->user_path));
+	return 0;
+}
+
 /*
  * Variant of alloc_empty_file() that allocates a backing_file container
  * and doesn't check and modify nr_files.
@@ -277,7 +288,14 @@ struct file *alloc_empty_backing_file(in
 		return ERR_PTR(error);
 	}
 
+	/* The f_mode flags must be set before fput(). */
 	ff->file.f_mode |= FMODE_BACKING | FMODE_NOACCOUNT;
+	error = init_backing_file(ff);
+	if (unlikely(error)) {
+		fput(&ff->file);
+		return ERR_PTR(error);
+	}
+
 	return &ff->file;
 }
 


Patches currently in stable-queue which might be from sashal@kernel.org are

queue-6.12/rxrpc-also-unshare-data-response-packets-when-paged-.patch
queue-6.12/mm-convert-mm_lock_seq-to-a-proper-seqcount.patch
queue-6.12/fs-prepare-for-adding-lsm-blob-to-backing_file.patch
queue-6.12/dma-mapping-drop-unneeded-includes-from-dma-mapping.h.patch
queue-6.12/mmc-core-optimize-time-for-secure-erase-trim-for-some-kingston-emmcs.patch
queue-6.12/x86-shadow-stacks-proper-error-handling-for-mmap-loc.patch
queue-6.12/net-txgbe-fix-rtnl-assertion-warning-when-remove-mod.patch
queue-6.12/erofs-move-in-out-pages-into-struct-z_erofs_decompress_req.patch
queue-6.12/dma-mapping-add-__dma_from_device_group_begin-end.patch
queue-6.12/rxrpc-fix-conn-level-packet-handling-to-unshare-resp.patch
queue-6.12/iommu-amd-use-atomic64_inc_return-in-iommu.c.patch
queue-6.12/crypto-nx-migrate-to-scomp-api.patch
queue-6.12/alsa-aloop-fix-peer-runtime-uaf-during-format-change-stop.patch
queue-6.12/udf-fix-partition-descriptor-append-bookkeeping.patch
queue-6.12/bluetooth-l2cap-fix-deadlock-in-l2cap_conn_del.patch
queue-6.12/kvm-x86-fix-shadow-paging-use-after-free-due-to-unex.patch
queue-6.12/hfsplus-fix-uninit-value-by-validating-catalog-record-size.patch
queue-6.12/crypto-nx-fix-bounce-buffer-leaks-in-nx842_crypto_-alloc-free-_ctx.patch
queue-6.12/gtp-disable-bh-before-calling-udp_tunnel_xmit_skb.patch
queue-6.12/net-stmmac-avoid-shadowing-global-buf_sz.patch
queue-6.12/crypto-caam-guard-hmac-key-hex-dumps-in-hash_digest_key.patch
queue-6.12/hfsplus-fix-held-lock-freed-on-hfsplus_fill_super.patch
queue-6.12/octeon_ep_vf-add-null-check-for-napi_build_skb.patch
queue-6.12/printk-add-print_hex_dump_devel.patch
queue-6.12/net-af_key-zero-aligned-sockaddr-tail-in-pf_key-expo.patch
queue-6.12/tracepoint-balance-regfunc-on-func_add-failure-in-tracepoint_add_func.patch
queue-6.12/flow_dissector-do-not-dissect-pppoe-pfc-frames.patch
queue-6.12/fbdev-defio-disconnect-deferred-i-o-from-the-lifetime-of-struct-fb_info.patch
queue-6.12/erofs-tidy-up-z_erofs_lz4_handle_overlap.patch
queue-6.12/iommu-amd-serialize-sequence-allocation-under-concur.patch
queue-6.12/x86-shstk-prevent-deadlock-during-shstk-sigreturn.patch
queue-6.12/erofs-fix-unsigned-underflow-in-z_erofs_lz4_handle_overlap.patch
queue-6.12/net-stmmac-prevent-null-deref-when-rx-memory-exhausted.patch
queue-6.12/net-stmmac-rename-stmmac_get_entry-stmmac_next_entry.patch
queue-6.12/mtd-spinand-winbond-declare-the-qe-bit-on-w25nxxjw.patch
queue-6.12/hwmon-powerz-avoid-cacheline-sharing-for-dma-buffer.patch
queue-6.12/wifi-mt76-mt7925-fix-incorrect-tlv-length-in-clc-command.patch