[PATCH AUTOSEL 6.17-6.16] io_uring/rsrc: respect submitter_task in io_register_clone_buffers()

[Sasha Levin <sashal@kernel.org>]

From: Caleb Sander Mateos <csander@purestorage.com>

[ Upstream commit 2f076a453f75de691a081c89bce31b530153d53b ]

io_ring_ctx's enabled with IORING_SETUP_SINGLE_ISSUER are only allowed
a single task submitting to the ctx. Although the documentation only
mentions this restriction applying to io_uring_enter() syscalls,
commit d7cce96c449e ("io_uring: limit registration w/ SINGLE_ISSUER")
extends it to io_uring_register(). Ensuring only one task interacts
with the io_ring_ctx will be important to allow this task to avoid
taking the uring_lock.
There is, however, one gap in these checks: io_register_clone_buffers()
may take the uring_lock on a second (source) io_ring_ctx, but
__io_uring_register() only checks the current thread against the
*destination* io_ring_ctx's submitter_task. Fail the
IORING_REGISTER_CLONE_BUFFERS with -EEXIST if the source io_ring_ctx has
a registered submitter_task other than the current task.

Signed-off-by: Caleb Sander Mateos <csander@purestorage.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

YES
**Why Backport**
- `io_uring/register.c:646` already enforces
  `IORING_SETUP_SINGLE_ISSUER` by rejecting registrations issued by any
  task other than `ctx->submitter_task`, but
  `io_register_clone_buffers()` still grabs `src_ctx->uring_lock`
  without checking `src_ctx->submitter_task` (see current flow in
  `io_uring/rsrc.c:1296-1305`). This lets a non-owner thread interact
  with the source ring, breaking the SINGLE_ISSUER contract introduced
  by d7cce96c449e.
- The patch plugs that only gap by validating `src_ctx->submitter_task
  == current` immediately after `lock_two_rings(ctx, src_ctx)` in
  `io_uring/rsrc.c`, and returning `-EEXIST` when another task tries to
  clone buffers. That keeps all rings with SINGLE_ISSUER consistent with
  the locking and lockdep assumptions documented in
  `io_uring/io_uring.h:136-144`.

**Impact Without Fix**
- A second task can still take `src_ctx->uring_lock` through cloning,
  undermining the guarantee that only the designated submitter ever
  touches that ring. Upcoming optimizations that skip `uring_lock` for
  the submitter rely on this guarantee; leaving the hole risks future
  functional regressions or lockdep splats once those changes land.
- Even today, the gap lets another thread stall a SINGLE_ISSUER ring by
  holding its lock via `IORING_REGISTER_CLONE_BUFFERS`, which
  contradicts users’ expectations after enabling SINGLE_ISSUER.

**Risk & Scope**
- Change is tiny and self-contained (one extra guard plus an early exit)
  with no data structure churn or ABI impact. Rings that are not flagged
  SINGLE_ISSUER have `submitter_task == NULL`, so behaviour is
  unchanged; legitimate same-thread clones still succeed.

**Backport Notes**
- Needs to go only into trees that already contain the clone-buffer
  support (`7cc2a6eadcd7` / `636119af94f2f`) and the SINGLE_ISSUER
  registration gating (`d7cce96c449e`). No further prerequisites
  identified.

 io_uring/rsrc.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
index f75f5e43fa4aa..e1e5f0fb0f56d 100644
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -1299,10 +1299,17 @@ int io_register_clone_buffers(struct io_ring_ctx *ctx, void __user *arg)
 	if (src_ctx != ctx) {
 		mutex_unlock(&ctx->uring_lock);
 		lock_two_rings(ctx, src_ctx);
+
+		if (src_ctx->submitter_task &&
+		    src_ctx->submitter_task != current) {
+			ret = -EEXIST;
+			goto out;
+		}
 	}
 
 	ret = io_clone_buffers(ctx, src_ctx, &buf);
 
+out:
 	if (src_ctx != ctx)
 		mutex_unlock(&src_ctx->uring_lock);
 
-- 
2.51.0