Re: [PATCH bpf-next] bpf: reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized

[Matt Bobrowski <mattbobrowski@google.com>]

On Tue, Jun 30, 2026 at 05:31:13PM +0200, Daniel Borkmann wrote:
> On 6/28/26 10:11 PM, Matt Bobrowski wrote:
> > When CONFIG_BPF_LSM=y is set, BPF inode storage maps
> > (BPF_MAP_TYPE_INODE_STORAGE) are compiled into the kernel. However,
> > if the BPF LSM is not explicitly enabled at boot time (e.g. omitted
> > from the "lsm=" boot parameter), lsm_prepare() is never executed for
> > the BPF LSM.
> > 
> > Consequently, the BPF inode security blob offset
> > (bpf_lsm_blob_sizes.lbs_inode) is never initialized and remains at its
> > default compiled size of 8 bytes instead of being updated to a valid
> > offset past the reserved struct rcu_head (typically 16 bytes or more).
> > 
> > When a privileged user creates and updates a
> > BPF_MAP_TYPE_INODE_STORAGE map, bpf_inode() evaluates
> > inode->i_security + 8. This erroneously aliases the struct
> > rcu_head.func callback pointer at the beginning of the
> > inode->i_security blob. During subsequent map element cleanup or inode
> > destruction, writing NULL to owner_storage clears the queued RCU
> > callback pointer. When rcu_do_batch() later executes the queued
> > callback, it attempts an instruction fetch at address 0x0, triggering
> > an immediate kernel panic.
> > 
> > Fix this by introducing a global bpf_lsm_initialized boolean flag
> > marked with __ro_after_init. Set this flag to true inside
> > bpf_lsm_init() when the LSM framework successfully registers the BPF
> > LSM. Gate map allocation in inode_storage_map_alloc() on this flag,
> > returning -EOPNOTSUPP if the BPF LSM is in turn uninitialized.
> > 
> > This fail-fast approach prevents userspace from allocating inode
> > storage maps when the supporting BPF LSM infrastructure is absent,
> > avoiding zombie map states.
> > 
> > Fixes: 8ea636848aca ("bpf: Implement bpf_local_storage for inodes")
> > Reported-by: oxsignal <awo@kakao.com>
> > Signed-off-by: Matt Bobrowski <mattbobrowski@google.com>
> 
> (Looks like pwbot is asleep; applied to bpf.)

Thank you Daniel!