A bunch of new hooks for managing block devices were added a while ago
but they weren't actually appropriately classified.

* bpf_lsm_bdev_alloc() is called when the inode for the block
  device is allocated. This happens from a sleepable context so mark the
  function as sleepable. When this function is called the memory for the
  block device storage embedded into the inode is zeroed. That block
  device cannot be meaningfully reference or interacted with at this
  point. So mark it as untrusted for now.

* bpf_lsm_bdev_free() is called when the inode for the block
  device is freed. A bunch of memory associated with the block device
  has already been freed and there's dangling pointers in there. So mark
  it as untrusted. It cannot be meaningfully referenced or interacted
  with anymore. It is also called from sb->s_op->free_inode:: which
  means it runs in rcu context (most of the times). So leave it as
  non-sleepable.

* bpf_lsm_bdev_setintegrity() is called when a dm-verity device
  is instantiated (glossing over details for simplicity of the commit
  message). The block device is very much alive so it remains a trusted
  hook. It's also called with device mapper's suspend lock held and so
  the hook is able to sleep so mark it sleepable.

Signed-off-by: Christian Brauner <brauner@kernel.org>
---
 kernel/bpf/bpf_lsm.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/bpf/bpf_lsm.c b/kernel/bpf/bpf_lsm.c
index 1da5585082fa..0887fcda4a9a 100644
--- a/kernel/bpf/bpf_lsm.c
+++ b/kernel/bpf/bpf_lsm.c
@@ -419,6 +419,8 @@ BTF_ID(func, bpf_lsm_userns_create)
 BTF_ID(func, bpf_lsm_namespace_alloc)
 BTF_ID(func, bpf_lsm_namespace_install)
 BTF_ID(func, bpf_lsm_cgroup_attach)
+BTF_ID(func, bpf_lsm_bdev_alloc)
+BTF_ID(func, bpf_lsm_bdev_setintegrity)
 BTF_SET_END(sleepable_lsm_hooks)
 
 BTF_SET_START(untrusted_lsm_hooks)
@@ -432,6 +434,8 @@ BTF_ID(func, bpf_lsm_sk_free_security)
 #endif /* CONFIG_SECURITY_NETWORK */
 BTF_ID(func, bpf_lsm_task_free)
 BTF_ID(func, bpf_lsm_namespace_free)
+BTF_ID(func, bpf_lsm_bdev_alloc)
+BTF_ID(func, bpf_lsm_bdev_free)
 BTF_SET_END(untrusted_lsm_hooks)
 
 bool bpf_lsm_is_sleepable_hook(u32 btf_id)

-- 
2.47.3

On Fri, Feb 20, 2026 at 06:48:48PM +0100, Christian Brauner wrote:
> A bunch of new hooks for managing block devices were added a while ago
> but they weren't actually appropriately classified.

> 
> * bpf_lsm_bdev_alloc() is called when the inode for the block
>   device is allocated. This happens from a sleepable context so mark the
>   function as sleepable. When this function is called the memory for the
>   block device storage embedded into the inode is zeroed. That block
>   device cannot be meaningfully reference or interacted with at this
>   point. So mark it as untrusted for now.
> 
> * bpf_lsm_bdev_free() is called when the inode for the block
>   device is freed. A bunch of memory associated with the block device
>   has already been freed and there's dangling pointers in there. So mark
>   it as untrusted. It cannot be meaningfully referenced or interacted
>   with anymore. It is also called from sb->s_op->free_inode:: which
>   means it runs in rcu context (most of the times). So leave it as
>   non-sleepable.

How did this even get added?  None of this should be of any business
to LSM hooks :(

On Fri, Feb 20, 2026 at 10:28:24AM -0800, Christoph Hellwig wrote:
> On Fri, Feb 20, 2026 at 06:48:48PM +0100, Christian Brauner wrote:
> > A bunch of new hooks for managing block devices were added a while ago
> > but they weren't actually appropriately classified.
> 
> > 
> > * bpf_lsm_bdev_alloc() is called when the inode for the block
> >   device is allocated. This happens from a sleepable context so mark the
> >   function as sleepable. When this function is called the memory for the
> >   block device storage embedded into the inode is zeroed. That block
> >   device cannot be meaningfully reference or interacted with at this
> >   point. So mark it as untrusted for now.
> > 
> > * bpf_lsm_bdev_free() is called when the inode for the block
> >   device is freed. A bunch of memory associated with the block device
> >   has already been freed and there's dangling pointers in there. So mark
> >   it as untrusted. It cannot be meaningfully referenced or interacted
> >   with anymore. It is also called from sb->s_op->free_inode:: which
> >   means it runs in rcu context (most of the times). So leave it as
> >   non-sleepable.
> 
> How did this even get added?  None of this should be of any business
> to LSM hooks :(

Fyi, it had nothing to do with bpf. That came as part of IPE about 2
years ago and gives that particular LSM the ability to track the
dm-verity status via the underlying block device so binary execution is
restricted to binaries from non-writable and dm-verity protected
filesystems (ignoring scripts for a second...).

This just appropriately classifies the hook for the verifier. It's the
same mechanism as security_alloc_*(). The fun part is though that while
the traditional LSM needs a pointer in struct block_device to allocate
storage for it a bpf lsm doesn't need that at all. It only needs the
hook itself and a hashmap. Or to say it more directly: this could've
always been a bpf lsm only without any additional in-kernel code for
this. But anyway, I'm using it.