From: Caleb Sander Mateos csander@purestorage.com
[ Upstream commit 2f076a453f75de691a081c89bce31b530153d53b ]
io_ring_ctx's enabled with IORING_SETUP_SINGLE_ISSUER are only allowed a single task submitting to the ctx. Although the documentation only mentions this restriction applying to io_uring_enter() syscalls, commit d7cce96c449e ("io_uring: limit registration w/ SINGLE_ISSUER") extends it to io_uring_register(). Ensuring only one task interacts with the io_ring_ctx will be important to allow this task to avoid taking the uring_lock. There is, however, one gap in these checks: io_register_clone_buffers() may take the uring_lock on a second (source) io_ring_ctx, but __io_uring_register() only checks the current thread against the *destination* io_ring_ctx's submitter_task. Fail the IORING_REGISTER_CLONE_BUFFERS with -EEXIST if the source io_ring_ctx has a registered submitter_task other than the current task.
Signed-off-by: Caleb Sander Mateos csander@purestorage.com Signed-off-by: Jens Axboe axboe@kernel.dk Signed-off-by: Sasha Levin sashal@kernel.org ---
LLM Generated explanations, may be completely bogus:
YES **Why Backport** - `io_uring/register.c:646` already enforces `IORING_SETUP_SINGLE_ISSUER` by rejecting registrations issued by any task other than `ctx->submitter_task`, but `io_register_clone_buffers()` still grabs `src_ctx->uring_lock` without checking `src_ctx->submitter_task` (see current flow in `io_uring/rsrc.c:1296-1305`). This lets a non-owner thread interact with the source ring, breaking the SINGLE_ISSUER contract introduced by d7cce96c449e. - The patch plugs that only gap by validating `src_ctx->submitter_task == current` immediately after `lock_two_rings(ctx, src_ctx)` in `io_uring/rsrc.c`, and returning `-EEXIST` when another task tries to clone buffers. That keeps all rings with SINGLE_ISSUER consistent with the locking and lockdep assumptions documented in `io_uring/io_uring.h:136-144`.
**Impact Without Fix** - A second task can still take `src_ctx->uring_lock` through cloning, undermining the guarantee that only the designated submitter ever touches that ring. Upcoming optimizations that skip `uring_lock` for the submitter rely on this guarantee; leaving the hole risks future functional regressions or lockdep splats once those changes land. - Even today, the gap lets another thread stall a SINGLE_ISSUER ring by holding its lock via `IORING_REGISTER_CLONE_BUFFERS`, which contradicts users’ expectations after enabling SINGLE_ISSUER.
**Risk & Scope** - Change is tiny and self-contained (one extra guard plus an early exit) with no data structure churn or ABI impact. Rings that are not flagged SINGLE_ISSUER have `submitter_task == NULL`, so behaviour is unchanged; legitimate same-thread clones still succeed.
**Backport Notes** - Needs to go only into trees that already contain the clone-buffer support (`7cc2a6eadcd7` / `636119af94f2f`) and the SINGLE_ISSUER registration gating (`d7cce96c449e`). No further prerequisites identified.
io_uring/rsrc.c | 7 +++++++ 1 file changed, 7 insertions(+)
diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c index f75f5e43fa4aa..e1e5f0fb0f56d 100644 --- a/io_uring/rsrc.c +++ b/io_uring/rsrc.c @@ -1299,10 +1299,17 @@ int io_register_clone_buffers(struct io_ring_ctx *ctx, void __user *arg) if (src_ctx != ctx) { mutex_unlock(&ctx->uring_lock); lock_two_rings(ctx, src_ctx); + + if (src_ctx->submitter_task && + src_ctx->submitter_task != current) { + ret = -EEXIST; + goto out; + } }
ret = io_clone_buffers(ctx, src_ctx, &buf);
+out: if (src_ctx != ctx) mutex_unlock(&src_ctx->uring_lock);