io_uring/register: enforce per-task restrictions in io_uring_register_blind()

When io_uring_register(2) is invoked with fd == -1, it dispatches directly to io_uring_register_blind() without checking current->io_uring_restrict.

As a result, a task with per-task register restrictions installed via IORING_REGISTER_RESTRICTIONS can still invoke blind registration opcodes such as IORING_REGISTER_SEND_MSG_RING even when those opcodes are not in the task's allowed register_op bitmap.

Check current->io_uring_restrict->register_op in io_uring_register_blind() before dispatching blind registration opcodes.

---
 io_uring/register.c | 7 +++++++
 1 file changed, 7 insertions(+)

index dab3eb4258df..5b26a5eddf3b 100644
@@ -1010,6 +1010,13 @@ static int io_uring_register_send_msg_ring(void __user *arg, unsigned int nr_arg
 static int io_uring_register_blind(unsigned int opcode, void __user *arg,
 				   unsigned int nr_args)
 {
+	if (current->io_uring_restrict &&
+	    current->io_uring_restrict->reg_registered) {
+		opcode = array_index_nospec(opcode, IORING_REGISTER_LAST);
+		if (!test_bit(opcode, current->io_uring_restrict->register_op))
+			return -EACCES;
+	}
+
 	switch (opcode) {
 	case IORING_REGISTER_SEND_MSG_RING:
 		return io_uring_register_send_msg_ring(arg, nr_args);

2.56.0.257.gf7497c7d27-goog

Applied, thanks!

[1/1] io_uring/register: enforce per-task restrictions in io_uring_register_blind()

      commit: 4a93427e99a8524f3612f29ec8bc0da5f8435a51

Best regards,

Jens Axboe