io_uring/chan: grab reference to destination ring

io_uring/chan: grab reference to destination ring

Grab a reference to the destination ring, and store it in the
io_queue_chan struct. When either end of the channel gets closed, eg
when either of the rings go away, then the reference is dropped
unconditionally. Hence the stored ctx must only be used within a RCU
read lock region.

Note that channels only support DEFER_TASKRUN targets, and such rings
will call synchronize_rcu() before the ring (and task) can go away. This
makes it safe to use ->dst_ring inside rcu_read_lock(), even though the
reference to the ring is put during unregistration.

Signed-off-by: Jens Axboe <axboe@kernel.dk>