[PATCH] io_uring/io-wq: stop a single cancel after one running match

[Mark Amirkan via B4 Relay]

From: Mark Amirkan <markdamirkan@xxxxxxxxx>

io_wq_worker_cancel() asks io_acct_for_each_worker() to stop after one
match when cancel_all is clear.  io_acct_cancel_running_work() discards
that result, so io_wq_cancel_running_work() continues into the other
worker account with nr_running already set.

If the first worker there also matches, one non-ALL cancel signals a
request in both the bounded and unbounded accounts.

Return the iterator result and stop scanning accounts after a match.
IORING_ASYNC_CANCEL_ALL is unchanged because its callback does not stop
the iteration.

A test runs a blocking open in the bounded account and a blocking
pipe-to-pipe splice in the unbounded account with the same user_data.
Before this change both operations are interrupted by one cancel.  After
the change only the open is interrupted, and the splice completes when
input is supplied.

Fixes: 751eedc4b4b7 ("io_uring/io-wq: move worker lists to struct io_wq_acct")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: Symbolic
Signed-off-by: Mark Amirkan <markdamirkan@xxxxxxxxx>
---
 io_uring/io-wq.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/io_uring/io-wq.c b/io_uring/io-wq.c
index 2ca223e47d..9f9039e3d3 100644
--- a/io_uring/io-wq.c
+++ b/io_uring/io-wq.c
@@ -1181,12 +1181,15 @@ static void io_wq_cancel_pending_work(struct io_wq *wq,
 	}
 }
 
-static void io_acct_cancel_running_work(struct io_wq_acct *acct,
+static bool io_acct_cancel_running_work(struct io_wq_acct *acct,
 					struct io_cb_cancel_data *match)
 {
+	bool ret;
+
 	raw_spin_lock(&acct->workers_lock);
-	io_acct_for_each_worker(acct, io_wq_worker_cancel, match);
+	ret = io_acct_for_each_worker(acct, io_wq_worker_cancel, match);
 	raw_spin_unlock(&acct->workers_lock);
+	return ret;
 }
 
 static void io_wq_cancel_running_work(struct io_wq *wq,
@@ -1195,7 +1198,8 @@ static void io_wq_cancel_running_work(struct io_wq *wq,
 	rcu_read_lock();
 
 	for (int i = 0; i < IO_WQ_ACCT_NR; i++)
-		io_acct_cancel_running_work(&wq->acct[i], match);
+		if (io_acct_cancel_running_work(&wq->acct[i], match))
+			break;
 
 	rcu_read_unlock();
 }

---
base-commit: 11773ae6da9c9d92f5d1def78f7e70a9f1fa7b1c
change-id: 20260913-b4-send-io-wq-cancel-507488f72245

Best regards,
--  
Mark Amirkan <markdamirkan@xxxxxxxxx>