7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dominik Maier Commit 4a93427e99a8524f3612f29ec8bc0da5f8435a51 upstream. When io_uring_register(2) is invoked with fd == -1, it dispatches directly to io_uring_register_blind() without checking current->io_uring_restrict. As a result, a task with per-task register restrictions installed via IORING_REGISTER_RESTRICTIONS can still invoke blind registration opcodes such as IORING_REGISTER_SEND_MSG_RING even when those opcodes are not in the task's allowed register_op bitmap. Check current->io_uring_restrict->register_op in io_uring_register_blind() before dispatching blind registration opcodes. Fixes: ed82f35b926b ("io_uring: allow registration of per-task restrictions") Assisted-by: ARTIST LLM Signed-off-by: Dominik Maier Link: https://patch.msgid.link/20261022232121.2538616-1-dmnk@google.com Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman --- io_uring/register.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/io_uring/register.c +++ b/io_uring/register.c @@ -1058,6 +1058,13 @@ static int io_uring_register_send_msg_ri static int io_uring_register_blind(unsigned int opcode, void __user *arg, unsigned int nr_args) { + if (current->io_uring_restrict && + current->io_uring_restrict->reg_registered) { + opcode = array_index_nospec(opcode, IORING_REGISTER_LAST); + if (!test_bit(opcode, current->io_uring_restrict->register_op)) + return -EACCES; + } + switch (opcode) { case IORING_REGISTER_SEND_MSG_RING: return io_uring_register_send_msg_ring(arg, nr_args);