[PATCH v2] io_uring/bpf_filter: Set src->bpf_filters_cow in io_bpf_filter_clone()

[PATCH v2] io_uring/bpf_filter: Set src->bpf_filters_cow in io_bpf_filter_clone()

[Hui Peng]

When io_bpf_filter_clone() clones a struct io_bpf_filters table from a
source restriction set to a destination restriction set, it increments
src->bpf_filters->refs and sets dst->bpf_filters_cow = true, but forgets
to set src->bpf_filters_cow = true.

As a result, subsequent IORING_REGISTER_BPF_FILTER registrations on an
io_uring instance or task holding the source restriction set bypass
copy-on-write and mutate the shared io_bpf_filters table in place,
corrupting the BPF filter rules of already-cloned rings.

Fix this by setting src->bpf_filters_cow = true alongside
dst->bpf_filters_cow = true in io_bpf_filter_clone().

Fixes: ed82f35b926b ("io_uring: allow registration of per-task restrictions")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
v2: Resend as plain text. v1 went out as PGP/MIME, which I now
understand is not wanted on the lists - apologies for the noise. Also
add a Fixes: tag and the Assisted-by: LLM tag.

io_bpf_filter_clone(), the bpf_filters_cow flag and its only consumer in
io_register_bpf_filter() were all added together by ed82f35b926b
("io_uring: allow registration of per-task restrictions"), first
released in v7.0-rc1, so that is the tag. Note d42eb05e60fe
("io_uring: add support for BPF filtering for opcode restrictions")
created bpf_filter.c and has a later author date because of a rebase,
but it predates ed82f35b926b in the history and contains neither
io_bpf_filter_clone() nor bpf_filters_cow.

To be clear about severity: this is a restriction-bypass / filter-set
corruption issue, not a memory-safety one. The refcount is taken
correctly and there is no use-after-free; the problem is purely that the
source side of the clone is never marked COW, so a later
IORING_REGISTER_BPF_FILTER on the source mutates the table that the
cloned ring is still using.

Found by code inspection; build tested only, no reproducer.

 io_uring/bpf_filter.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/io_uring/bpf_filter.c b/io_uring/bpf_filter.c
index c0037632b7af..4a21511c4811 100644
--- a/io_uring/bpf_filter.c
+++ b/io_uring/bpf_filter.c
@@ -253,6 +253,7 @@ void io_bpf_filter_clone(struct io_restriction *dst, struct io_restriction *src)
 	 * If the src filter is going away, just ignore it.
 	 */
 	if (refcount_inc_not_zero(&src->bpf_filters->refs)) {
+		src->bpf_filters_cow = true;
 		dst->bpf_filters = src->bpf_filters;
 		dst->bpf_filters_cow = true;
 	}

Re: [PATCH v2] io_uring/bpf_filter: Set src->bpf_filters_cow in io_bpf_filter_clone()

[Jens Axboe]

On 9/19/26 5:25 AM, Hui Peng wrote:
> When io_bpf_filter_clone() clones a struct io_bpf_filters table from a
> source restriction set to a destination restriction set, it increments
> src->bpf_filters->refs and sets dst->bpf_filters_cow = true, but forgets
> to set src->bpf_filters_cow = true.
> 
> As a result, subsequent IORING_REGISTER_BPF_FILTER registrations on an
> io_uring instance or task holding the source restriction set bypass
> copy-on-write and mutate the shared io_bpf_filters table in place,
> corrupting the BPF filter rules of already-cloned rings.
> 
> Fix this by setting src->bpf_filters_cow = true alongside
> dst->bpf_filters_cow = true in io_bpf_filter_clone().

This one looks fine. But:

> Found by code inspection; build tested only, no reproducer.

run the test suite. As far as I can tell from your patches, "code inspection"
simply means an LLM looked at it for you. Do you even look at the code? It's
clear it hasn't been run.

In the future, don't send patches without having tested them. And tell your
LLM to refrain from both the overly verbose and alarmist writing.

-- 
Jens Axboe