[GIT PULL] fsverity fixes for v7.4-rc1

[GIT PULL] fsverity fixes for v7.4-rc1

[Eric Biggers]

The following changes since commit 8a36f53fd5ec3eff01f1b637d42cbdc3821d0493:

  Merge tag 'mm-stable-2026-10-25-19-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm (2026-10-27 12:23:17 -1000)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/fs/fsverity/linux.git tags/fsverity-for-linus

for you to fetch changes up to c349b233d6ab0fc3517401a1e2d36f5f90eb8c9b:

  fsverity: Set S_VERITY only after rollback is no longer possible (2026-10-28 10:53:43 -0700)

----------------------------------------------------------------

Fixes for several bugs found by LLMs:

- Fix bypass of IPE's fsverity support, and a use-after-free in
  certain cases, when FS_IOC_ENABLE_VERITY fails when almost done.

- Fix FS_IOC_MEASURE_VERITY and FS_IOC_READ_VERITY_METADATA to no
  longer bypass Landlock and AppArmor's read permission checks.

- Be robust against the filesystem returning different values for a
  file's verity descriptor length in two successive queries.

----------------------------------------------------------------
Eric Biggers (4):
      fsverity: Explicitly require FMODE_READ to retrieve hashes
      fsverity: Be more careful with return value of ->get_verity_descriptor()
      fsverity: Tell LSMs about signature only after verity is enabled
      fsverity: Set S_VERITY only after rollback is no longer possible

 Documentation/filesystems/fsverity.rst |  3 ++
 fs/btrfs/verity.c                      |  7 +++--
 fs/ext4/verity.c                       |  4 ++-
 fs/verity/enable.c                     | 20 ++++++++-----
 fs/verity/fsverity_private.h           |  8 +++++
 fs/verity/measure.c                    | 10 +++++++
 fs/verity/open.c                       | 47 +++++++++++++++++------------
 fs/verity/read_metadata.c              | 14 ++++++---
 fs/verity/signature.c                  | 55 ++++++++++++++++++++++++----------
 include/linux/fsverity.h               | 12 ++++----
 10 files changed, 126 insertions(+), 54 deletions(-)