io_uring/rsrc: respect submitter_task in io_register_clone_buffers()

[ Upstream commit 2f076a453f75de691a081c89bce31b530153d53b ]

io_ring_ctx's enabled with IORING_SETUP_SINGLE_ISSUER are only allowed
a single task submitting to the ctx. Although the documentation only
mentions this restriction applying to io_uring_enter() syscalls,
commit d7cce96c449e ("io_uring: limit registration w/ SINGLE_ISSUER")
extends it to io_uring_register(). Ensuring only one task interacts
with the io_ring_ctx will be important to allow this task to avoid
taking the uring_lock.
There is, however, one gap in these checks: io_register_clone_buffers()
may take the uring_lock on a second (source) io_ring_ctx, but
__io_uring_register() only checks the current thread against the
*destination* io_ring_ctx's submitter_task. Fail the
IORING_REGISTER_CLONE_BUFFERS with -EEXIST if the source io_ring_ctx has
a registered submitter_task other than the current task.

Signed-off-by: Caleb Sander Mateos <csander@purestorage.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
index f75f5e43fa4aad7ceefd27a25e25ba989e1edd7c..e1e5f0fb0f56ddbf8eeceb51e891e9c5445c5f0e 100644 (file)
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -1299,10 +1299,17 @@ int io_register_clone_buffers(struct io_ring_ctx *ctx, void __user *arg)
        if (src_ctx != ctx) {
                mutex_unlock(&ctx->uring_lock);
                lock_two_rings(ctx, src_ctx);
+
+               if (src_ctx->submitter_task &&
+                   src_ctx->submitter_task != current) {
+                       ret = -EEXIST;
+                       goto out;
+               }
        }
 
        ret = io_clone_buffers(ctx, src_ctx, &buf);
 
+out:
        if (src_ctx != ctx)
                mutex_unlock(&src_ctx->uring_lock);