Re: [PATCH v2] io_uring/bpf_filter: Set src->bpf_filters_cow in io_bpf_filter_clone()

[Jens Axboe <axboe@kernel.dk>]

On 9/19/26 5:25 AM, Hui Peng wrote:
> When io_bpf_filter_clone() clones a struct io_bpf_filters table from a
> source restriction set to a destination restriction set, it increments
> src->bpf_filters->refs and sets dst->bpf_filters_cow = true, but forgets
> to set src->bpf_filters_cow = true.
> 
> As a result, subsequent IORING_REGISTER_BPF_FILTER registrations on an
> io_uring instance or task holding the source restriction set bypass
> copy-on-write and mutate the shared io_bpf_filters table in place,
> corrupting the BPF filter rules of already-cloned rings.
> 
> Fix this by setting src->bpf_filters_cow = true alongside
> dst->bpf_filters_cow = true in io_bpf_filter_clone().

This one looks fine. But:

> Found by code inspection; build tested only, no reproducer.

run the test suite. As far as I can tell from your patches, "code inspection"
simply means an LLM looked at it for you. Do you even look at the code? It's
clear it hasn't been run.

In the future, don't send patches without having tested them. And tell your
LLM to refrain from both the overly verbose and alarmist writing.

-- 
Jens Axboe