Merge tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux

Pull fsverity fixes from Eric Biggers:
 "Fixes for several bugs found by LLMs:

   - Fix bypass of IPE's fsverity support, and a use-after-free in
     certain cases, when FS_IOC_ENABLE_VERITY fails when almost done

   - Fix FS_IOC_MEASURE_VERITY and FS_IOC_READ_VERITY_METADATA to no
     longer bypass Landlock and AppArmor's read permission checks

   - Be robust against the filesystem returning different values for a
     file's verity descriptor length in two successive queries"

* tag 'fsverity-for-linus' of git://git.kernel.org/pub/scm/fs/fsverity/linux:
  fsverity: Set S_VERITY only after rollback is no longer possible
  fsverity: Tell LSMs about signature only after verity is enabled
  fsverity: Be more careful with return value of ->get_verity_descriptor()
  fsverity: Explicitly require FMODE_READ to retrieve hashes