[PATCH bpf-next] bpf: Fix security_bpf_map_create error handling

[PATCH bpf-next] bpf: Fix security_bpf_map_create error handling

[Daniel Borkmann]

Commit 5816bf4273ed ("lsm,selinux: Add LSM blob support for BPF objects")
made the LSM hook wrappers for BPF object creation clean up the LSM
state internally upon denial, e.g. security_bpf_map_create() internally
calls security_bpf_map_free() when the bpf_map_create hook returns an
error. map_create() however still routes a denial to its free_map_sec
label, which invokes security_bpf_map_free() a second time, so the
bpf_map_free hook fires twice for a single denied map.

In-tree LSMs are unaffected in practice since the blob kfree() inside
security_bpf_map_free() is NULL-safe and idempotent and none of them
implement bpf_map_free, but a BPF LSM program attached to that hook
observes double invocations. Route the denial to free_map instead.

Fixes: 5816bf4273ed ("lsm,selinux: Add LSM blob support for BPF objects")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
---
 kernel/bpf/syscall.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 358f2b0ce2bd..0ff9e3aa293d 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -1649,7 +1649,7 @@ static int map_create(union bpf_attr *attr, bpfptr_t uattr, struct bpf_common_at
 
 	err = security_bpf_map_create(map, attr, token, uattr.is_kernel);
 	if (err)
-		goto free_map_sec;
+		goto free_map;
 
 	err = bpf_map_alloc_id(map);
 	if (err)
-- 
2.43.0

Re: [PATCH bpf-next] bpf: Fix security_bpf_map_create error handling

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] Incomplete fix: the double LSM hook invocation bug fixed for maps also exists in the BPF program load path.
--

--- Patch [1]: [PATCH bpf-next] bpf: Fix security_bpf_map_create error handling ---
commit cf9b2144a32439abed11faad9a9b189d6b3f71f7
Author: Daniel Borkmann <daniel@iogearbox.net>

bpf: Fix security_bpf_map_create error handling

This commit prevents the security_bpf_map_free() hook from being called
twice when map creation is denied. It routes the map_create() denial
path to free_map instead of free_map_sec.

> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -1649,7 +1649,7 @@ static int map_create(union bpf_attr *attr, bpfptr_t uattr, struct bpf_common_at
>  
>  	err = security_bpf_map_create(map, attr, token, uattr.is_kernel);
>  	if (err)
> -		goto free_map_sec;
> +		goto free_map;
>  
>  	err = bpf_map_alloc_id(map);
>  	if (err)

[Severity: Medium]
This isn't a bug introduced by this patch, but since you are fixing the
double invocation for maps, does the exact same issue also exist in the
BPF program load path?

Looking at the program load path, security_bpf_prog_load() cleans up the
LSM state internally upon denial:

security/security.c:security_bpf_prog_load() {
    ...
	if (unlikely(rc))
		security_bpf_prog_free(prog);
    ...
}

However, the error path in bpf_prog_load() eventually initiates an
unconditional program teardown:

kernel/bpf/syscall.c:bpf_prog_load() {
    ...
free_used_maps:
	/* In case we have subprogs, we need to wait for a grace
	 * period before we can tear down JIT memory since symbols
	 * are already exposed under kallsyms.
	 */
	__bpf_prog_put_noref(prog, prog->aux->real_func_cnt);
    ...
}

Which then unconditionally calls the free hook again:

kernel/bpf/syscall.c:__bpf_prog_put_rcu() {
    ...
	security_bpf_prog_free(aux->prog);
    ...
}

Could this lead to double invocations for denied programs (or unbalanced
invocations if verification fails before reaching the LSM load hook),
creating unexpected states for BPF LSM programs attached to bpf_prog_free?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260709073422.379247-1-daniel@iogearbox.net?part=1

Re: [PATCH bpf-next] bpf: Fix security_bpf_map_create error handling

[Daniel Borkmann]

On 7/9/26 9:48 AM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> 
> Pre-existing issues:
> - [Medium] Incomplete fix: the double LSM hook invocation bug fixed for maps also exists in the BPF program load path.
Yeap, I'm on that one as well, but sending separately.

Re: [PATCH bpf-next] bpf: Fix security_bpf_map_create error handling

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf-next.git (master)
by Kumar Kartikeya Dwivedi <memxor@gmail.com>:

On Thu,  9 Jul 2026 09:34:22 +0200 you wrote:
> Commit 5816bf4273ed ("lsm,selinux: Add LSM blob support for BPF objects")
> made the LSM hook wrappers for BPF object creation clean up the LSM
> state internally upon denial, e.g. security_bpf_map_create() internally
> calls security_bpf_map_free() when the bpf_map_create hook returns an
> error. map_create() however still routes a denial to its free_map_sec
> label, which invokes security_bpf_map_free() a second time, so the
> bpf_map_free hook fires twice for a single denied map.
> 
> [...]

Here is the summary with links:
  - [bpf-next] bpf: Fix security_bpf_map_create error handling
    https://git.kernel.org/bpf/bpf-next/c/36ffa86c42f9

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html