[PATCH] io_uring: consistently use rcu semantics with sqpoll thread

[Keith Busch <kbusch@meta.com>]

From: Keith Busch <kbusch@kernel.org>

It is already dereferenced with rcu read protection, so it needs to be
annotated as such, and consistently use rcu helpers for access and
assignment.

Fixes: ac0b8b327a5677d ("io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo()")
Signed-off-by: Keith Busch <kbusch@kernel.org>
---
 io_uring/sqpoll.c | 16 +++++++++-------
 io_uring/sqpoll.h |  2 +-
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/io_uring/sqpoll.c b/io_uring/sqpoll.c
index 0625a421626f4..7c6d7de05e0a0 100644
--- a/io_uring/sqpoll.c
+++ b/io_uring/sqpoll.c
@@ -30,7 +30,7 @@ enum {
 void io_sq_thread_unpark(struct io_sq_data *sqd)
 	__releases(&sqd->lock)
 {
-	WARN_ON_ONCE(sqd->thread == current);
+	WARN_ON_ONCE(rcu_access_pointer(sqd->thread) == current);
 
 	/*
 	 * Do the dance but not conditional clear_bit() because it'd race with
@@ -46,24 +46,24 @@ void io_sq_thread_unpark(struct io_sq_data *sqd)
 void io_sq_thread_park(struct io_sq_data *sqd)
 	__acquires(&sqd->lock)
 {
-	WARN_ON_ONCE(data_race(sqd->thread) == current);
+	WARN_ON_ONCE(data_race(rcu_access_pointer(sqd->thread)) == current);
 
 	atomic_inc(&sqd->park_pending);
 	set_bit(IO_SQ_THREAD_SHOULD_PARK, &sqd->state);
 	mutex_lock(&sqd->lock);
 	if (sqd->thread)
-		wake_up_process(sqd->thread);
+		wake_up_process(rcu_access_pointer(sqd->thread));
 }
 
 void io_sq_thread_stop(struct io_sq_data *sqd)
 {
-	WARN_ON_ONCE(sqd->thread == current);
+	WARN_ON_ONCE(rcu_access_pointer(sqd->thread) == current);
 	WARN_ON_ONCE(test_bit(IO_SQ_THREAD_SHOULD_STOP, &sqd->state));
 
 	set_bit(IO_SQ_THREAD_SHOULD_STOP, &sqd->state);
 	mutex_lock(&sqd->lock);
 	if (sqd->thread)
-		wake_up_process(sqd->thread);
+		wake_up_process(rcu_access_pointer(sqd->thread));
 	mutex_unlock(&sqd->lock);
 	wait_for_completion(&sqd->exited);
 }
@@ -486,7 +486,7 @@ __cold int io_sq_offload_create(struct io_ring_ctx *ctx,
 			goto err_sqpoll;
 		}
 
-		sqd->thread = tsk;
+		rcu_assign_pointer(sqd->thread, tsk);
 		task_to_put = get_task_struct(tsk);
 		ret = io_uring_alloc_task_context(tsk, ctx);
 		wake_up_new_task(tsk);
@@ -517,7 +517,9 @@ __cold int io_sqpoll_wq_cpu_affinity(struct io_ring_ctx *ctx,
 		io_sq_thread_park(sqd);
 		/* Don't set affinity for a dying thread */
 		if (sqd->thread)
-			ret = io_wq_cpu_affinity(sqd->thread->io_uring, mask);
+			ret = io_wq_cpu_affinity(
+				rcu_access_pointer(sqd->thread)->io_uring,
+				mask);
 		io_sq_thread_unpark(sqd);
 	}
 
diff --git a/io_uring/sqpoll.h b/io_uring/sqpoll.h
index 4171666b1cf4c..43f69d3cf2959 100644
--- a/io_uring/sqpoll.h
+++ b/io_uring/sqpoll.h
@@ -8,7 +8,7 @@ struct io_sq_data {
 	/* ctx's that are using this sqd */
 	struct list_head	ctx_list;
 
-	struct task_struct	*thread;
+	struct task_struct __rcu *thread;
 	struct wait_queue_head	wait;
 
 	unsigned		sq_thread_idle;
-- 
2.47.1