Merge: io_uring/rsrc: require cloned buffers to share accounting contexts

MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/368

JIRA: https://issues.redhat.com/browse/RHEL-78677
CVE: CVE-2025-21686

Signed-off-by: Jeff Moyer <jmoyer@redhat.com>

Approved-by: Ming Lei <ming.lei@redhat.com>
Approved-by: Brian Foster <bfoster@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: Jan Stancek <jstancek@redhat.com>

Author: jstancek

io_uring/rsrc.c

@@ -1153,6 +1153,13 @@ static int io_clone_buffers(struct io_ring_ctx *ctx, struct io_ring_ctx *src_ctx
 	struct io_rsrc_data *data;
 	int i, ret, nbufs;
 
+	/*
+	 * Accounting state is shared between the two rings; that only works if
+	 * both rings are accounted towards the same counters.
+	 */
+	if (ctx->user != src_ctx->user || ctx->mm_account != src_ctx->mm_account)
+		return -EINVAL;
+
 	/*
 	 * Drop our own lock here. We'll setup the data we need and reference
 	 * the source buffers, then re-grab, check, and assign at the end.