[PATCH] workqueue: annotate the lockless nr_running read in need_more_worker()
From: Nguyen Ngoc Thang
Date: Mon Oct 12 2026 - 10:44:31 EST
wq_worker_running() increments pool->nr_running with only preemption
disabled, while kick_pool_pick() reads it via need_more_worker() under
pool->lock, so the two can run concurrently on different CPUs. KCSAN
reports:
BUG: KCSAN: data-race in kick_pool_pick / wq_worker_running
write to 0xffff888059c2af24 of 4 bytes by task 3007 on cpu 0:
wq_worker_running+0x114/0x130
schedule_timeout+0x16e/0x180
io_schedule_timeout+0x4c/0x70
submit_bio_wait+0xd7/0x110
blkdev_issue_flush+0x4c/0x70
ext4_sync_file+0x60d/0x6c0
aio_fsync_work+0x7f/0x270
process_one_work+0x4ae/0xa00
read to 0xffff888059c2af24 of 4 bytes by task 3001 on cpu 1:
kick_pool_pick+0x7a/0x3a0
__queue_work+0x72d/0xcf0
queue_work_on+0x9d/0xb0
schedule_on_each_cpu+0x11a/0x2d0
vmstat_refresh+0x23/0x140
proc_sys_call_handler+0x2b9/0x4f0
The race is benign: nr_running only goes 0 -> 1 here, and a stale 0
merely causes a spurious wakeup of an idle worker. Annotate the read
with data_race().
Reported-by: syzbot+8922e6b8343f70be92e8@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=8922e6b8343f70be92e8
Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@xxxxxxxxx>
---
kernel/workqueue.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 1ae3732a2c51..18e74d9a0696 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -951,7 +951,11 @@ static unsigned long work_offqd_pack_flags(struct work_offq_data *offqd)
*/
static bool need_more_worker(struct worker_pool *pool)
{
- return !list_empty(&pool->worklist) && !pool->nr_running;
+ /*
+ * wq_worker_running() bumps nr_running without pool->lock. A stale
+ * read at worst causes a spurious wakeup, so the race is benign.
+ */
+ return !list_empty(&pool->worklist) && !data_race(pool->nr_running);
}
/* Can I start working? Called from busy but !running workers. */
--
2.43.0