Re: [PATCH v2] io_uring: add submitter_task consistency check to io_install_bpf()

[Gabriel Krisman Bertazi <krisman@suse.de>]

Ali Raza <elirazamumtaz@gmail.com> writes:

> io_uring_register() already guards against a different task touching
> a SINGLE_ISSUER ring (register.c:733):
>
>     if (ctx->submitter_task && ctx->submitter_task != current)
>         return -EEXIST;
>
> bpf_io_reg() calls io_install_bpf() without an equivalent guard.  Add
> the same check for consistency.  The check is gated on
> IORING_SETUP_SINGLE_ISSUER since submitter_task is only assigned for
> that flag combination (io_uring.c:3053 and register.c:282).
>
> Note: io_install_bpf() is called directly from the BPF syscall path,
> so `current` is the task invoking BPF_LINK_CREATE.  If BPF link
> registration were ever deferred to a worker thread, this check would
> need revisiting.
>
> Signed-off-by: Ali Raza <elirazamumtaz@gmail.com>
> ---
> v2: Added IORING_SETUP_SINGLE_ISSUER gate; changed -EPERM to -EEXIST to
>     match register.c:733; removed security/exploit framing from commit
>     message; acknowledged that `current` may not be valid if BPF link
>     creation is ever deferred to a worker thread.
>
>  io_uring/bpf-ops.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/io_uring/bpf-ops.c b/io_uring/bpf-ops.c
> index 937e48bef40b..84578614cc0b 100644
> --- a/io_uring/bpf-ops.c
> +++ b/io_uring/bpf-ops.c
> @@ -162,6 +162,9 @@ static int io_install_bpf(struct io_ring_ctx *ctx, struct io_uring_bpf_ops *ops)
>  		return -EOPNOTSUPP;
>  	if (!(ctx->flags & IORING_SETUP_DEFER_TASKRUN))
>  		return -EOPNOTSUPP;
> +	if ((ctx->flags & IORING_SETUP_SINGLE_ISSUER) &&
> +	    ctx->submitter_task && ctx->submitter_task != current)

The ctx->flags & IORING_SETUP_SINGLE_ISSUER check is redundant. IIUC,
->submitter_task can only be set if the ring is set with
IORING_SETUP_SINGLE_ISSUER.

> +		return -EEXIST;
>
>  	if (ctx->bpf_ops)
>  		return -EBUSY;
> --
> 2.43.0

-- 
Gabriel Krisman Bertazi