[PATCH 6.6.y] io_uring/io-wq: fix worker accounting when canceling creation callbacks

[PATCH 6.6.y] io_uring/io-wq: fix worker accounting when canceling creation callbacks

[Vishnu Razdan via B4 Relay]

From: Vishnu Razdan <vrazdan@openai.com>

commit 297b5ccea4acacaa47c150f043bce695202afbf1 upstream.

create_worker_cb() reserves an io-wq worker slot only after its
task-work callback runs. If the callback is canceled before then,
io_worker_cancel_cb() still decrements acct->nr_workers. When an
existing worker retires with its creation callback pending, that
worker has already decremented the same account's worker count.

The resulting undercount permits worker creation beyond the account's
configured limit. On an AST2600 OpenBMC system, an unchanged sensor
daemon reached 4,291 threads with the original kernel. With an
equivalent downstream fix, 25 passive samples under its normal
workload showed 6-9 threads.

Decrement nr_workers only when the canceled callback is not
create_worker_cb(). Continuation callbacks still release their reserved
slot, and both callback types retain the existing running-count,
reference-count, and create-state cleanup.

[ Backport: retain the existing wq->lock protecting worker accounting. ]

Fixes: 1d5f5ea7cb7d ("io-wq: remove worker to owner tw dependency")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6-sol
Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>
Link: https://patch.msgid.link/20260811-vrazdan-io-wq-b4-submit-v1-1-719ced16c921@openai.com
Signed-off-by: Vishnu Razdan <vrazdan@openai.com>
---
Stable backport for linux-6.6.y.
---
 io_uring/io-wq.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/io_uring/io-wq.c b/io_uring/io-wq.c
index 37725c5031b4c2..a20be1a43aafcf 100644
--- a/io_uring/io-wq.c
+++ b/io_uring/io-wq.c
@@ -193,9 +193,12 @@ static void io_worker_cancel_cb(struct io_worker *worker)
 	struct io_wq *wq = worker->wq;
 
 	atomic_dec(&acct->nr_running);
-	raw_spin_lock(&wq->lock);
-	acct->nr_workers--;
-	raw_spin_unlock(&wq->lock);
+	/* create_worker_cb() has not reserved a worker slot yet. */
+	if (worker->create_work.func != create_worker_cb) {
+		raw_spin_lock(&wq->lock);
+		acct->nr_workers--;
+		raw_spin_unlock(&wq->lock);
+	}
 	io_worker_ref_put(wq);
 	clear_bit_unlock(0, &worker->create_state);
 	io_worker_release(worker);

---
base-commit: dc6160265ffc795a1832bc1424f58291d152c7bb
change-id: 20260825-stable-io-wq-6-6-y-ba2c3fc5c2c7

Best regards,
--  
Vishnu Razdan <vrazdan@openai.com>

[PATCH 6.6.y] io_uring/io-wq: fix worker accounting when canceling creation callbacks

[Vishnu Razdan]

commit 297b5ccea4acacaa47c150f043bce695202afbf1 upstream.

create_worker_cb() reserves an io-wq worker slot only after its
task-work callback runs. If the callback is canceled before then,
io_worker_cancel_cb() still decrements acct->nr_workers. When an
existing worker retires with its creation callback pending, that
worker has already decremented the same account's worker count.

The resulting undercount permits worker creation beyond the account's
configured limit. On an AST2600 OpenBMC system, an unchanged sensor
daemon reached 4,291 threads with the original kernel. With an
equivalent downstream fix, 25 passive samples under its normal
workload showed 6-9 threads.

Decrement nr_workers only when the canceled callback is not
create_worker_cb(). Continuation callbacks still release their reserved
slot, and both callback types retain the existing running-count,
reference-count, and create-state cleanup.

[ Backport: retain the existing wq->lock protecting worker accounting. ]

Fixes: 1d5f5ea7cb7d ("io-wq: remove worker to owner tw dependency")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6-sol
Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>
Link: https://patch.msgid.link/20260811-vrazdan-io-wq-b4-submit-v1-1-719ced16c921@openai.com
Signed-off-by: Vishnu Razdan <vrazdan@openai.com>
---
Stable backport for linux-6.6.y.
---
 io_uring/io-wq.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/io_uring/io-wq.c b/io_uring/io-wq.c
index 37725c5031b4c2..a20be1a43aafcf 100644
--- a/io_uring/io-wq.c
+++ b/io_uring/io-wq.c
@@ -193,9 +193,12 @@ static void io_worker_cancel_cb(struct io_worker *worker)
 	struct io_wq *wq = worker->wq;
 
 	atomic_dec(&acct->nr_running);
-	raw_spin_lock(&wq->lock);
-	acct->nr_workers--;
-	raw_spin_unlock(&wq->lock);
+	/* create_worker_cb() has not reserved a worker slot yet. */
+	if (worker->create_work.func != create_worker_cb) {
+		raw_spin_lock(&wq->lock);
+		acct->nr_workers--;
+		raw_spin_unlock(&wq->lock);
+	}
 	io_worker_ref_put(wq);
 	clear_bit_unlock(0, &worker->create_state);
 	io_worker_release(worker);

---
base-commit: dc6160265ffc795a1832bc1424f58291d152c7bb
change-id: 20260825-stable-io-wq-6-6-y-ba2c3fc5c2c7

Best regards,
--  
Vishnu Razdan <vrazdan@openai.com>

Re: [PATCH 6.6.y] io_uring/io-wq: fix worker accounting when canceling creation callbacks

[Sasha Levin]

> Decrement nr_workers only when the canceled callback is not
> create_worker_cb(). Continuation callbacks still release their reserved
> slot, and both callback types retain the existing running-count,
> reference-count, and create-state cleanup.
>
> [ Backport: retain the existing wq->lock protecting worker accounting. ]

Queued for 6.6, thanks.

I also used this patch for 6.12.

-- 
Thanks,
Sasha

Re: [PATCH 6.6.y] io_uring/io-wq: fix worker accounting when canceling creation callbacks

[Jens Axboe]

On 8/27/26 7:46 PM, Sasha Levin wrote:
>> Decrement nr_workers only when the canceled callback is not
>> create_worker_cb(). Continuation callbacks still release their reserved
>> slot, and both callback types retain the existing running-count,
>> reference-count, and create-state cleanup.
>>
>> [ Backport: retain the existing wq->lock protecting worker accounting. ]
> 
> Queued for 6.6, thanks.
> 
> I also used this patch for 6.12.

Thanks for doing this - and I'm assuming the AUTOSEL stuff is both
adapting patches so they apply, and pulling in prerequisites? If
so, I love it, imho this is exactly what it should be doing. Helps
maintainers out a lot.

-- 
Jens Axboe

Re: [PATCH 6.6.y] io_uring/io-wq: fix worker accounting when canceling creation callbacks

[Sasha Levin]

On Thu, Aug 27, 2026 at 08:02:34PM -0600, Jens Axboe wrote:
>On 8/27/26 7:46 PM, Sasha Levin wrote:
>>> Decrement nr_workers only when the canceled callback is not
>>> create_worker_cb(). Continuation callbacks still release their reserved
>>> slot, and both callback types retain the existing running-count,
>>> reference-count, and create-state cleanup.
>>>
>>> [ Backport: retain the existing wq->lock protecting worker accounting. ]
>>
>> Queued for 6.6, thanks.
>>
>> I also used this patch for 6.12.
>
>Thanks for doing this - and I'm assuming the AUTOSEL stuff is both
>adapting patches so they apply, and pulling in prerequisites? If

Exactly! It can also do minor adaptations to the prereqs as needed (think cases
like tree-wide changes).

>so, I love it, imho this is exactly what it should be doing. Helps
>maintainers out a lot.

Thanks for the feedback!

-- 
Thanks,
Sasha