io_uring/fdinfo: lock SQ thread while retrieving thread cpu/pid

We could race with SQ thread exit, and if we do, we'll hit a NULL pointer
dereference when the thread is cleared. Grab the SQPOLL data lock before
attempting to get the task cpu and pid for fdinfo, this ensures we have a
stable view of it.

Cc: stable@vger.kernel.org
Link: https://bugzilla.kernel.org/show_bug.cgi?id=218032
Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/fdinfo.c b/io_uring/fdinfo.c
index c536788754164293058b2b852493293369828124..f04a43044d917ceef45fc5a2acfb1910978dd0f3 100644 (file)
--- a/io_uring/fdinfo.c
+++ b/io_uring/fdinfo.c
@@ -53,7 +53,6 @@ static __cold int io_uring_show_cred(struct seq_file *m, unsigned int id,
 __cold void io_uring_show_fdinfo(struct seq_file *m, struct file *f)
 {
        struct io_ring_ctx *ctx = f->private_data;
-       struct io_sq_data *sq = NULL;
        struct io_overflow_cqe *ocqe;
        struct io_rings *r = ctx->rings;
        unsigned int sq_mask = ctx->sq_entries - 1, cq_mask = ctx->cq_entries - 1;
@@ -64,6 +63,7 @@ __cold void io_uring_show_fdinfo(struct seq_file *m, struct file *f)
        unsigned int cq_shift = 0;
        unsigned int sq_shift = 0;
        unsigned int sq_entries, cq_entries;
+       int sq_pid = -1, sq_cpu = -1;
        bool has_lock;
        unsigned int i;
 
@@ -143,13 +143,19 @@ __cold void io_uring_show_fdinfo(struct seq_file *m, struct file *f)
        has_lock = mutex_trylock(&ctx->uring_lock);
 
        if (has_lock && (ctx->flags & IORING_SETUP_SQPOLL)) {
-               sq = ctx->sq_data;
-               if (!sq->thread)
-                       sq = NULL;
+               struct io_sq_data *sq = ctx->sq_data;
+
+               if (mutex_trylock(&sq->lock)) {
+                       if (sq->thread) {
+                               sq_pid = task_pid_nr(sq->thread);
+                               sq_cpu = task_cpu(sq->thread);
+                       }
+                       mutex_unlock(&sq->lock);
+               }
        }
 
-       seq_printf(m, "SqThread:\t%d\n", sq ? task_pid_nr(sq->thread) : -1);
-       seq_printf(m, "SqThreadCpu:\t%d\n", sq ? task_cpu(sq->thread) : -1);
+       seq_printf(m, "SqThread:\t%d\n", sq_pid);
+       seq_printf(m, "SqThreadCpu:\t%d\n", sq_cpu);
        seq_printf(m, "UserFiles:\t%u\n", ctx->nr_user_files);
        for (i = 0; has_lock && i < ctx->nr_user_files; i++) {
                struct file *f = io_file_from_index(&ctx->file_table, i);