mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2025-08-15 11:41:35 +00:00
c538f400fa
The sqpoll thread is dereferenced with rcu read protection in one place,
so it needs to be annotated as an __rcu type, and should consistently
use rcu helpers for access and assignment to make sparse happy.
Since most of the accesses occur under the sqd->lock, we can use
rcu_dereference_protected() without declaring an rcu read section.
Provide a simple helper to get the thread from a locked context.
Fixes: ac0b8b327a ("io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo()")
Signed-off-by: Keith Busch <kbusch@kernel.org>
Link: https://lore.kernel.org/r/20250611205343.1821117-1-kbusch@meta.com
[axboe: fold in fix for register.c]
Signed-off-by: Jens Axboe <axboe@kernel.dk>
38 lines
1019 B
C
38 lines
1019 B
C
// SPDX-License-Identifier: GPL-2.0
|
|
|
|
struct io_sq_data {
|
|
refcount_t refs;
|
|
atomic_t park_pending;
|
|
struct mutex lock;
|
|
|
|
/* ctx's that are using this sqd */
|
|
struct list_head ctx_list;
|
|
|
|
struct task_struct __rcu *thread;
|
|
struct wait_queue_head wait;
|
|
|
|
unsigned sq_thread_idle;
|
|
int sq_cpu;
|
|
pid_t task_pid;
|
|
pid_t task_tgid;
|
|
|
|
u64 work_time;
|
|
unsigned long state;
|
|
struct completion exited;
|
|
};
|
|
|
|
int io_sq_offload_create(struct io_ring_ctx *ctx, struct io_uring_params *p);
|
|
void io_sq_thread_finish(struct io_ring_ctx *ctx);
|
|
void io_sq_thread_stop(struct io_sq_data *sqd);
|
|
void io_sq_thread_park(struct io_sq_data *sqd);
|
|
void io_sq_thread_unpark(struct io_sq_data *sqd);
|
|
void io_put_sq_data(struct io_sq_data *sqd);
|
|
void io_sqpoll_wait_sq(struct io_ring_ctx *ctx);
|
|
int io_sqpoll_wq_cpu_affinity(struct io_ring_ctx *ctx, cpumask_var_t mask);
|
|
|
|
static inline struct task_struct *sqpoll_task_locked(struct io_sq_data *sqd)
|
|
{
|
|
return rcu_dereference_protected(sqd->thread,
|
|
lockdep_is_held(&sqd->lock));
|
|
}
|