Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

io_uring/io-wq: fix `max_workers` breakage and `nr_workers` underflow

Commit 88e6c42e40de ("io_uring/io-wq: add check free worker before
create new worker") reused the variable `do_create` for something
else, abusing it for the free worker check.

This caused the value to effectively always be `true` at the time
`nr_workers < max_workers` was checked, but it should really be
`false`. This means the `max_workers` setting was ignored, and worse:
if the limit had already been reached, incrementing `nr_workers` was
skipped even though another worker would be created.

When later lots of workers exit, the `nr_workers` field could easily
underflow, making the problem worse because more and more workers
would be created without incrementing `nr_workers`.

The simple solution is to use a different variable for the free worker
check instead of using one variable for two different things.

Cc: stable@vger.kernel.org
Fixes: 88e6c42e40de ("io_uring/io-wq: add check free worker before create new worker")
Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
Reviewed-by: Fengnan Chang <changfengnan@bytedance.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

authored by

Max Kellermann and committed by
Jens Axboe
cd4ea81b 98b6fa62

+3 -3
+3 -3
io_uring/io-wq.c
··· 352 352 struct io_wq *wq; 353 353 354 354 struct io_wq_acct *acct; 355 - bool do_create = false; 355 + bool activated_free_worker, do_create = false; 356 356 357 357 worker = container_of(cb, struct io_worker, create_work); 358 358 wq = worker->wq; 359 359 acct = worker->acct; 360 360 361 361 rcu_read_lock(); 362 - do_create = !io_acct_activate_free_worker(acct); 362 + activated_free_worker = io_acct_activate_free_worker(acct); 363 363 rcu_read_unlock(); 364 - if (!do_create) 364 + if (activated_free_worker) 365 365 goto no_need_create; 366 366 367 367 raw_spin_lock(&acct->workers_lock);