[STABLE REQUEST] bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized

[STABLE REQUEST] bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized

[oxsignal]

Hi,

I am the original reporter of this bug. Please backport upstream commit

a6f0643e4f63cfaa0d5d4a69de4f132eac4b8fe4
("bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is 
uninitialized")

to all affected supported stable trees (5.10.y and newer).

When CONFIG_BPF_LSM=y but the BPF LSM is not enabled at boot, creating
and updating a BPF_MAP_TYPE_INODE_STORAGE map can use an uninitialized
inode security blob offset and overwrite the rcu_head.func callback.
Later cleanup may execute a NULL callback and panic the kernel.

The issue was introduced by commit 8ea636848aca
("bpf: Implement bpf_local_storage for inodes"), included since v5.10.
The fix has been in mainline since v7.2-rc2.

I reproduced the panic on unmodified official Ubuntu cloud images:

1. Ubuntu 24.04.4 LTS
    Image: 
https://cloud-images.ubuntu.com/releases/24.04/release/ubuntu-24.04-server-cloudimg-amd64.img
    Kernel: 6.8.0-124-generic
    CONFIG_BPF_LSM=y
    CONFIG_LSM="landlock,lockdown,yama,integrity,apparmor"
    Active LSMs: lockdown,capability,landlock,yama,apparmor

2. Ubuntu 26.04 LTS
    Image: 
https://cloud-images.ubuntu.com/releases/26.04/release/ubuntu-26.04-server-cloudimg-amd64.img
    Kernel: 7.0.0-22-generic
    CONFIG_BPF_LSM=y
    CONFIG_LSM="landlock,lockdown,yama,integrity,apparmor"
    Active LSMs: lockdown,capability,landlock,yama,apparmor,ima,evm

In both cases, CONFIG_BPF_LSM is enabled but the BPF LSM is excluded
from the default CONFIG_LSM list and is inactive at runtime. This
demonstrates that the bug is reachable with default configurations of
supported distribution kernels, without a custom kernel build.

Thanks,
oxsignal

Re: [STABLE REQUEST] bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized

[Greg KH]

On Thu, Jul 16, 2026 at 02:45:35AM +0900, oxsignal wrote:
> Hi,
> 
> I am the original reporter of this bug. Please backport upstream commit
> 
> a6f0643e4f63cfaa0d5d4a69de4f132eac4b8fe4
> ("bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is
> uninitialized")
> 
> to all affected supported stable trees (5.10.y and newer).

It does not apply to 6.18.y or older, please provide a working backport
if you wish to see it in those trees.

thanks,

greg k-hj