[PATCH v2] io_uring: add submitter_task consistency check to io_install_bpf()

[Ali Raza <elirazamumtaz@gmail.com>]

io_uring_register() already guards against a different task touching
a SINGLE_ISSUER ring (register.c:733):

    if (ctx->submitter_task && ctx->submitter_task != current)
        return -EEXIST;

bpf_io_reg() calls io_install_bpf() without an equivalent guard.  Add
the same check for consistency.  The check is gated on
IORING_SETUP_SINGLE_ISSUER since submitter_task is only assigned for
that flag combination (io_uring.c:3053 and register.c:282).

Note: io_install_bpf() is called directly from the BPF syscall path,
so `current` is the task invoking BPF_LINK_CREATE.  If BPF link
registration were ever deferred to a worker thread, this check would
need revisiting.

Signed-off-by: Ali Raza <elirazamumtaz@gmail.com>
---
v2: Added IORING_SETUP_SINGLE_ISSUER gate; changed -EPERM to -EEXIST to
    match register.c:733; removed security/exploit framing from commit
    message; acknowledged that `current` may not be valid if BPF link
    creation is ever deferred to a worker thread.

 io_uring/bpf-ops.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/io_uring/bpf-ops.c b/io_uring/bpf-ops.c
index 937e48bef40b..84578614cc0b 100644
--- a/io_uring/bpf-ops.c
+++ b/io_uring/bpf-ops.c
@@ -162,6 +162,9 @@ static int io_install_bpf(struct io_ring_ctx *ctx, struct io_uring_bpf_ops *ops)
 		return -EOPNOTSUPP;
 	if (!(ctx->flags & IORING_SETUP_DEFER_TASKRUN))
 		return -EOPNOTSUPP;
+	if ((ctx->flags & IORING_SETUP_SINGLE_ISSUER) &&
+	    ctx->submitter_task && ctx->submitter_task != current)
+		return -EEXIST;

 	if (ctx->bpf_ops)
 		return -EBUSY;
--
2.43.0