[PATCH 0/3] workqueue: sparse and wq_node_nr_active() fixes

[PATCH 0/3] workqueue: sparse and wq_node_nr_active() fixes

[Breno Leitao]

This is a follow up for the patchset named "workqueue: base pwq pool
release and nr_active on the backing pool"

Patches 1 and 2 answer a 0-day sparse report against the percpu pwq
allocation path, bisected to commit 79f23600bc7b ("workqueue: factor out
get_percpu_pool()").

https://lore.kernel.org/all/202608120931.tvTzq1gD-lkp@intel.com/

The warning is not new, that commit only turned the offending assignment
into an initializer. wq->cpu_pwq is an array of __rcu pointers, but
workqueue_congested(), the allocation path and its error path all go
through it with plain loads and stores. Use the matching RCU accessors
instead.

With the two patches kernel/workqueue.c is sparse clean.

Patch 3 is a separate review fix: wq_node_nr_active() warns and returns
NULL for a per-cpu workqueue, which only moves the oops into the caller.

This has been stress tested with a "debug" kernel and wqtest test-suite:
https://github.com/leitao/wqtest

Signed-off-by: Breno Leitao <leitao@debian.org>
---
Breno Leitao (3):
      workqueue: use rcu_dereference_sched() in workqueue_congested()
      workqueue: use RCU accessors when populating wq->cpu_pwq
      workqueue: BUG_ON() instead of returning NULL in wq_node_nr_active()

 kernel/workqueue.c | 24 ++++++++++++++----------
 1 file changed, 14 insertions(+), 10 deletions(-)
---
base-commit: 5e6de6a2b522f659defacb1551d0465ba6ce13cf
change-id: 20260812-wq_fix-be919bd89542

Best regards,
--  
Breno Leitao <leitao@debian.org>

[PATCH 1/3] workqueue: use rcu_dereference_sched() in workqueue_congested()

[Breno Leitao]

workqueue_congested() fetches the pwq out of wq->cpu_pwq with a plain
load, so sparse complains about the dropped __rcu:

  kernel/workqueue.c:6304:13: sparse: incorrect type in assignment (different address spaces) @@     expected struct pool_workqueue *pwq @@     got struct pool_workqueue [noderef] __rcu * @@

A pwq is released with kfree_rcu() and the read is protected by the
surrounding preempt_disable(), which is what
commit fd5081f4ef33 ("workqueue: Remove redundant rcu_read_lock/unlock() in
workqueue_congested()") relied on when it dropped the rcu_read_lock()
here.

Use the rcu_dereference_sched() helper to make that explicit.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202608120931.tvTzq1gD-lkp@intel.com/
Signed-off-by: Breno Leitao <leitao@debian.org>
---
 kernel/workqueue.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index de888e043d115..1748ef5541a26 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -6317,7 +6317,7 @@ bool workqueue_congested(int cpu, struct workqueue_struct *wq)
 	if (cpu == WORK_CPU_UNBOUND)
 		cpu = smp_processor_id();
 
-	pwq = *per_cpu_ptr(wq->cpu_pwq, cpu);
+	pwq = rcu_dereference_sched(*per_cpu_ptr(wq->cpu_pwq, cpu));
 	ret = !list_empty(&pwq->inactive_works);
 
 	preempt_enable();

-- 
2.53.0-Meta

[PATCH 2/3] workqueue: use RCU accessors when populating wq->cpu_pwq

[Breno Leitao]

wq->cpu_pwq holds RCU-protected pwq pointers, but the percpu allocation
path fills it in with plain loads and stores, which sparse flags:

  kernel/workqueue.c:5682:57: sparse: incorrect type in initializer (different address spaces) @@     expected struct pool_workqueue **pwq_p @@     got struct pool_workqueue [noderef] __rcu ** @@

Allocate the array as __rcu pointers and publish each pwq with
rcu_assign_pointer() once it is initialized and linked, the order
install_unbound_pwq() uses.

The warnings are not new: commit 79f23600bc7b ("workqueue: factor out
get_percpu_pool()") only turned the flagged assignment into an
initializer.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202608120931.tvTzq1gD-lkp@intel.com/
Signed-off-by: Breno Leitao <leitao@debian.org>
---
 kernel/workqueue.c | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 1748ef5541a26..83aced28523b5 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -5681,21 +5681,23 @@ static void unbound_wq_update_pwq(struct workqueue_struct *wq, int cpu)
 
 static int alloc_and_link_percpu_pwqs(struct workqueue_struct *wq)
 {
+	struct pool_workqueue *pwq;
 	int cpu;
 
 	for_each_possible_cpu(cpu) {
-		struct pool_workqueue **pwq_p = per_cpu_ptr(wq->cpu_pwq, cpu);
 		struct worker_pool *pool = get_percpu_pool(wq, cpu);
 
-		*pwq_p = kmem_cache_alloc_node(pwq_cache, GFP_KERNEL, pool->node);
-		if (!*pwq_p)
+		pwq = kmem_cache_alloc_node(pwq_cache, GFP_KERNEL, pool->node);
+		if (!pwq)
 			return -ENOMEM;
 
-		init_pwq(*pwq_p, wq, pool);
+		init_pwq(pwq, wq, pool);
 
 		mutex_lock(&wq->mutex);
-		link_pwq(*pwq_p);
+		link_pwq(pwq);
 		mutex_unlock(&wq->mutex);
+
+		rcu_assign_pointer(*per_cpu_ptr(wq->cpu_pwq, cpu), pwq);
 	}
 
 	return 0;
@@ -5708,7 +5710,7 @@ static int alloc_and_link_pwqs(struct workqueue_struct *wq)
 
 	lockdep_assert_held(&wq_pool_mutex);
 
-	wq->cpu_pwq = alloc_percpu(struct pool_workqueue *);
+	wq->cpu_pwq = alloc_percpu(struct pool_workqueue __rcu *);
 	if (!wq->cpu_pwq)
 		goto enomem;
 
@@ -5734,8 +5736,11 @@ static int alloc_and_link_pwqs(struct workqueue_struct *wq)
 enomem:
 	if (wq->cpu_pwq) {
 		for_each_possible_cpu(cpu) {
-			struct pool_workqueue *pwq = *per_cpu_ptr(wq->cpu_pwq, cpu);
+			struct pool_workqueue __rcu **slot;
+			struct pool_workqueue *pwq;
 
+			slot = per_cpu_ptr(wq->cpu_pwq, cpu);
+			pwq = rcu_access_pointer(*slot);
 			if (pwq) {
 				/*
 				 * Unlink pwq from wq->pwqs since link_pwq()

-- 
2.53.0-Meta

[PATCH 3/3] workqueue: BUG_ON() instead of returning NULL in wq_node_nr_active()

[Breno Leitao]

wq_node_nr_active() warns and returns NULL when @wq is not unbound, but
every caller dereferences the result right away, so the WARN_ON_ONCE()
only moves the oops one frame up, as raised by Tejun.

Fix it by BUGing_ON() instead of this silly WARN_ON_ONCE();

Fixes: b72fdc651056 ("workqueue: account nr_active by the backing pool")
Suggested-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Breno Leitao <leitao@debian.org>
---
 kernel/workqueue.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 83aced28523b5..cbc416147dcaa 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -1625,8 +1625,7 @@ static bool is_percpu_pool(struct worker_pool *pool)
 static struct wq_node_nr_active *wq_node_nr_active(struct workqueue_struct *wq,
 						   int node)
 {
-	if (WARN_ON_ONCE(!(wq->flags & WQ_UNBOUND)))
-		return NULL;
+	BUG_ON(!(wq->flags & WQ_UNBOUND));
 
 	if (node == NUMA_NO_NODE)
 		node = nr_node_ids;

-- 
2.53.0-Meta

Re: [PATCH 0/3] workqueue: sparse and wq_node_nr_active() fixes

[Tejun Heo]

On Wed, Aug 12, 2026 at 09:03:17AM -0700, Breno Leitao wrote:
> Breno Leitao (3):
>       workqueue: use rcu_dereference_sched() in workqueue_congested()
>       workqueue: use RCU accessors when populating wq->cpu_pwq
>       workqueue: BUG_ON() instead of returning NULL in wq_node_nr_active()

Applied 1-3 to wq/for-7.3.

Thanks.

-- 
tejun