From: sashiko-bot@kernel.org
To: "Justin Suess" <utilityemal77@gmail.com>
Cc: bpf@vger.kernel.org
Subject: Re: [PATCH bpf-next 02/13] lsm: Add LSM hook security_policy_kptr_put
Date: Fri, 31 Jul 2026 02:44:54 +0000 [thread overview]
Message-ID: <20260731024454.C71801F000E9@smtp.kernel.org> (raw)
In-Reply-To: <20260731022047.189137-3-utilityemal77@gmail.com>
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The WARN_ON_ONCE for a dispatch miss is bypassed if the caller erroneously passes LSM_ID_BPF, resulting in a silent leak.
--
--- Patch [2]: [PATCH bpf-next 02/13] lsm: Add LSM hook security_policy_kptr_put ---
commit 6653ce935258422e0de519b7ec4e4610455b2e51
Author: Justin Suess <utilityemal77@gmail.com>
lsm: Add LSM hook security_policy_kptr_put
This commit adds a generic LSM hook for releasing a reference obtained
through security_policy_kptr_from_fd(). The hook uses targeted dispatch
by lsmid and includes a warning on a dispatch miss to prevent silent leaks.
> diff --git a/security/security.c b/security/security.c
> index 14fd8b878cd07..fd535bd00c244 100644
> --- a/security/security.c
> +++ b/security/security.c
[ ... ]
> @@ -5479,6 +5479,33 @@ int security_policy_kptr_from_fd(u64 lsmid, int fd,
> return LSM_RET_DEFAULT(policy_kptr_from_fd);
> }
>
> +/**
> + * security_policy_kptr_put() - Put a reference on an LSM policy object
> + * @lsmid: LSM_ID_* value of the LSM owning @policy
> + * @policy: the policy object, in the member of the LSM identified by
> + * @lsmid
> + *
> + * Release a reference previously obtained with
> + * security_policy_kptr_from_fd(). Only the hook implementation
> + * of the LSM identified by @lsmid is called, and @policy must have
> + * been obtained from that same LSM. An implementation must support
> + * being called from a context that cannot sleep: the release of BPF
> + * managed references may be driven from object destructors.
> + */
> +void security_policy_kptr_put(u64 lsmid, union lsm_policy_kptr *policy)
> +{
> + struct lsm_static_call *scall;
> +
> + lsm_for_each_hook(scall, policy_kptr_put) {
> + if (scall->hl->lsmid->id != lsmid)
> + continue;
> + scall->hl->hook.policy_kptr_put(policy);
> + return;
> + }
> + /* A held reference implies the matching LSM implements the hook. */
> + WARN_ON_ONCE(1);
> +}
[Severity: Medium]
Will this warning be bypassed if a caller mistakenly passes LSM_ID_BPF?
The commit message states that a dispatch miss means a caller passed the
wrong lsmid, and that the shim warns instead of silently leaking the
reference.
However, since the BPF LSM automatically registers a void-returning stub for
all LSM hooks (bpf_lsm_policy_kptr_put), it appears the dispatch loop will
match LSM_ID_BPF, call the empty stub, and return early.
Could this result in a silent leak without triggering the WARN_ON_ONCE(1)?
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260731022047.189137-1-utilityemal77@gmail.com?part=2
next prev parent reply other threads:[~2026-07-31 2:44 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-31 2:20 [PATCH bpf-next 00/13] BPF interface for applying Landlock rulesets Justin Suess
2026-07-31 2:20 ` [PATCH bpf-next 01/13] lsm: Add LSM hook security_policy_kptr_from_fd Justin Suess
2026-07-31 2:20 ` [PATCH bpf-next 02/13] lsm: Add LSM hook security_policy_kptr_put Justin Suess
2026-07-31 2:44 ` sashiko-bot [this message]
2026-07-31 2:20 ` [PATCH bpf-next 03/13] lsm: Add LSM hook security_bprm_enforce_policy_kptr Justin Suess
2026-07-31 2:20 ` [PATCH bpf-next 04/13] landlock: Expose the ruleset fd lookup to the rest of Landlock Justin Suess
2026-07-31 2:20 ` [PATCH bpf-next 05/13] landlock: Factor the credential restriction out of landlock_restrict_self() Justin Suess
2026-07-31 2:20 ` [PATCH bpf-next 06/13] landlock: Implement the LSM policy kptr hooks Justin Suess
2026-07-31 2:20 ` [PATCH bpf-next 07/13] bpf: Add the LSM policy kfunc infrastructure Justin Suess
2026-07-31 2:20 ` [PATCH bpf-next 08/13] bpf: Add the bpf_landlock_put_ruleset kfunc and ruleset destructor Justin Suess
2026-07-31 2:46 ` sashiko-bot
2026-07-31 2:20 ` [PATCH bpf-next 09/13] bpf: Add the bpf_landlock_get_ruleset_from_fd kfunc Justin Suess
2026-07-31 2:20 ` [PATCH bpf-next 10/13] bpf: Add the bpf_landlock_restrict_binprm kfunc Justin Suess
2026-07-31 2:46 ` sashiko-bot
2026-07-31 2:20 ` [PATCH bpf-next 11/13] selftests/bpf: Add tests for the Landlock policy kfuncs Justin Suess
2026-07-31 2:20 ` [PATCH bpf-next 12/13] landlock: Document the BPF kfunc interface Justin Suess
2026-07-31 2:45 ` sashiko-bot
2026-07-31 2:20 ` [PATCH bpf-next 13/13] lsm: Document the LSM policy kptr hooks Justin Suess
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260731024454.C71801F000E9@smtp.kernel.org \
--to=sashiko-bot@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
--cc=utilityemal77@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox