diff options
| author | Caleb Sander Mateos <csander@purestorage.com> | 2025-09-04 11:08:59 -0600 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2025-09-08 13:21:24 -0600 |
| commit | 2f076a453f75de691a081c89bce31b530153d53b (patch) | |
| tree | 076ba6e528d756e0354a37355ddf970795ca5d81 /io_uring/rsrc.c | |
| parent | 5d4c52bfa8cdc1dc1ff701246e662be3f43a3fe1 (diff) | |
io_uring/rsrc: respect submitter_task in io_register_clone_buffers()
io_ring_ctx's enabled with IORING_SETUP_SINGLE_ISSUER are only allowed
a single task submitting to the ctx. Although the documentation only
mentions this restriction applying to io_uring_enter() syscalls,
commit d7cce96c449e ("io_uring: limit registration w/ SINGLE_ISSUER")
extends it to io_uring_register(). Ensuring only one task interacts
with the io_ring_ctx will be important to allow this task to avoid
taking the uring_lock.
There is, however, one gap in these checks: io_register_clone_buffers()
may take the uring_lock on a second (source) io_ring_ctx, but
__io_uring_register() only checks the current thread against the
*destination* io_ring_ctx's submitter_task. Fail the
IORING_REGISTER_CLONE_BUFFERS with -EEXIST if the source io_ring_ctx has
a registered submitter_task other than the current task.
Signed-off-by: Caleb Sander Mateos <csander@purestorage.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'io_uring/rsrc.c')
| -rw-r--r-- | io_uring/rsrc.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c index 2d15b8785a95..d787c16dc1c3 100644 --- a/io_uring/rsrc.c +++ b/io_uring/rsrc.c @@ -1300,10 +1300,17 @@ int io_register_clone_buffers(struct io_ring_ctx *ctx, void __user *arg) if (src_ctx != ctx) { mutex_unlock(&ctx->uring_lock); lock_two_rings(ctx, src_ctx); + + if (src_ctx->submitter_task && + src_ctx->submitter_task != current) { + ret = -EEXIST; + goto out; + } } ret = io_clone_buffers(ctx, src_ctx, &buf); +out: if (src_ctx != ctx) mutex_unlock(&src_ctx->uring_lock); |