[PATCH bpf-next v3 06/15] lsm: Add the bpf_lsm_policy_acquire kfunc

[bot+bpf-ci at kernel.org]

> diff --git a/security/bpf_lsm_kfuncs.c b/security/bpf_lsm_kfuncs.c
> index 988dcd6f4dd9..43a4bf57fd31 100644
> --- a/security/bpf_lsm_kfuncs.c
> +++ b/security/bpf_lsm_kfuncs.c
> @@ -14,6 +14,36 @@
>
>  __bpf_kfunc_start_defs();
>
> +/**
> + * bpf_lsm_policy_acquire - Acquire a reference on a shared policy object
> + * @object: RCU-protected pointer to a policy object, e.g. loaded from
> + *          a map kptr field under bpf_rcu_read_lock()
> + *
> + * Acquire a reference of its own on a policy object the program does
> + * not own, so that any number of concurrent program executions can
> + * use the object shared through one map kptr field, without emptying
> + * it as bpf_kptr_xchg() would.  The returned reference stays valid
> + * after bpf_rcu_read_unlock() and must be released with
> + * bpf_lsm_policy_release().
> + *
> + * Return: A referenced policy object, or NULL if the object's
> + * reference count concurrently dropped to zero.
> + */

This isn't a bug, but would it be worth spelling out the other NULL
cases here -- no enabled LSM owning @object->lsmid, or the owning LSM's
get hook failing -- the way bpf_lsm_policy_from_fd()'s Return: section
does just below?

The current text names one of the three ways the kfunc yields NULL. The
body also returns NULL when no enabled LSM's policy_object_get static
call matches @object->lsmid, and when the owning LSM's hook fails for a
reason other than a dead refcount.

> +__bpf_kfunc struct lsm_policy_object *
> +bpf_lsm_policy_acquire(struct lsm_policy_object *object)
> +{
> +	struct lsm_static_call *scall;
> +
> +	lsm_for_each_hook(scall, policy_object_get) {
> +		if (scall->hl->lsmid->id != object->lsmid)
> +			continue;
> +		if (scall->hl->hook.policy_object_get(object))
> +			return NULL;
> +		return object;
> +	}
> +	return NULL;
> +}


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/34398515657