Commit 35d442ed1f86 for kernel

commit 35d442ed1f86465e49df3119fb898f985186db13
Author: Andrea Parri <parri.andrea@gmail.com>
Date:   Tue Sep 22 16:55:30 2026 +0200

    bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir

    bpf_lsm_has_d_inode_locked() makes the verifier rewrite
    bpf_[set|remove]_dentry_xattr() to the _locked variants, which assume
    that the caller already holds the inode's i_rwsem.  The path_unlink and
    path_rmdir hooks are listed, but security_path_unlink() and
    security_path_rmdir() run before vfs_unlink()/vfs_rmdir() take the
    victim inode's i_rwsem, so a sleepable BPF LSM program attached to
    either hook mutates the victim's xattrs without the lock held.

    Drop the two path hooks from d_inode_locked_hooks so that the verifier
    keeps the locking bpf_[set|remove]_dentry_xattr() variants, which take
    the lock themselves.

    Fixes: 56467292794b8 ("bpf: fs/xattr: Add BPF kfuncs to set and remove xattrs")
    Cc: stable@vger.kernel.org
    Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
    Link: https://patch.msgid.link/20260922145530.369775-1-parri.andrea@gmail.com
    Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

diff --git a/fs/bpf_fs_kfuncs.c b/fs/bpf_fs_kfuncs.c
index 6cb877267978..357a379ef92a 100644
--- a/fs/bpf_fs_kfuncs.c
+++ b/fs/bpf_fs_kfuncs.c
@@ -472,10 +472,6 @@ BTF_ID(func, bpf_lsm_inode_rmdir)
 BTF_ID(func, bpf_lsm_inode_setattr)
 BTF_ID(func, bpf_lsm_inode_setxattr)
 BTF_ID(func, bpf_lsm_inode_unlink)
-#ifdef CONFIG_SECURITY_PATH
-BTF_ID(func, bpf_lsm_path_unlink)
-BTF_ID(func, bpf_lsm_path_rmdir)
-#endif /* CONFIG_SECURITY_PATH */
 BTF_SET_END(d_inode_locked_hooks)

 bool bpf_lsm_has_d_inode_locked(const struct bpf_prog *prog)