[PATCH] io_uring/sqpoll: don't set IO_SQ_THREAD_SHOULD_STOP on thread exit

[PATCH] io_uring/sqpoll: don't set IO_SQ_THREAD_SHOULD_STOP on thread exit

[Shuai Liu]

io_sq_thread_stop() carries a WARN_ON_ONCE() asserting that
IO_SQ_THREAD_SHOULD_STOP isn't set yet, i.e. that stopping the SQPOLL
thread is never attempted twice. Since commit 22d9db9fd64a
("io_uring/sqpoll: don't attach to a thread that is canceling"), the
SQPOLL thread itself sets that bit on its way out, so that
io_sq_offload_create() won't attach a new ring to a thread that is
canceling.

When the thread exits on a fatal signal, the bit is thus set before the
ring teardown gets to io_sq_thread_stop(), which now triggers the
warning on every such exit:

  WARNING: io_uring/sqpoll.c:88 at io_sq_thread_stop
  Workqueue: iou_exit io_ring_exit_work
  Call Trace:
   io_put_sq_data
   io_sq_thread_finish
   io_ring_ctx_free
   io_ring_exit_work

Introduce a separate IO_SQ_THREAD_EXITING bit for the thread marking
itself as on its way out, and check it in io_sq_offload_create() along
with IO_SQ_THREAD_SHOULD_STOP. IO_SQ_THREAD_SHOULD_STOP regains its
original meaning, "a stop has been requested", and the WARN_ON_ONCE()
holds again.

Reproduced with an SQPOLL ring and an immediate fatal signal: the
warning fires on v7.3.0+ (22d9db9fd64a present) and is gone with this
change.

Reported-by: syzbot+675af112519ca34f5502@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=675af112519ca34f5502
Fixes: 22d9db9fd64a ("io_uring/sqpoll: don't attach to a thread that is canceling")
Signed-off-by: Shuai Liu <847807867@qq.com>
---
 io_uring/sqpoll.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/io_uring/sqpoll.c b/io_uring/sqpoll.c
index c833e776320d..bbfb1a6e6668 100644
--- a/io_uring/sqpoll.c
+++ b/io_uring/sqpoll.c
@@ -29,6 +29,7 @@
 enum {
 	IO_SQ_THREAD_SHOULD_STOP = 0,
 	IO_SQ_THREAD_SHOULD_PARK,
+	IO_SQ_THREAD_EXITING,
 };
 
 void io_sq_thread_unpark(struct io_sq_data *sqd)
@@ -436,9 +437,12 @@ static int io_sq_thread(void *data)
 	/*
 	 * Cancelation drops sqd->lock while it waits, and a ring could attach
 	 * to a thread that is on its way out. A fatal signal doesn't set the
-	 * bit, so set it here for io_sq_offload_create() to see.
+	 * stop bit, so mark the thread as exiting here for
+	 * io_sq_offload_create() to see. IO_SQ_THREAD_SHOULD_STOP is left
+	 * alone, as it means a stop has been requested via
+	 * io_sq_thread_stop().
 	 */
-	set_bit(IO_SQ_THREAD_SHOULD_STOP, &sqd->state);
+	set_bit(IO_SQ_THREAD_EXITING, &sqd->state);
 	io_uring_cancel_generic(true, sqd);
 	rcu_assign_pointer(sqd->thread, NULL);
 	put_task_struct(current);
@@ -510,7 +514,8 @@ __cold int io_sq_offload_create(struct io_ring_ctx *ctx,
 		/* don't attach to a dying SQPOLL thread, would be racy */
 		ret = 0;
 		if (attached && (!sqd->thread ||
-		    test_bit(IO_SQ_THREAD_SHOULD_STOP, &sqd->state)))
+		    test_bit(IO_SQ_THREAD_SHOULD_STOP, &sqd->state) ||
+		    test_bit(IO_SQ_THREAD_EXITING, &sqd->state)))
 			ret = -ENXIO;
 		io_sq_thread_unpark(sqd);
 
-- 
2.43.0

Re: [PATCH] io_uring/sqpoll: don't set IO_SQ_THREAD_SHOULD_STOP on thread exit

[Breno Leitao]

On Mon, Nov 02, 2026 at 04:05:42PM +0800, Shuai Liu wrote:
>   WARNING: io_uring/sqpoll.c:88 at io_sq_thread_stop
>   Workqueue: iou_exit io_ring_exit_work
>   Call Trace:
>    io_put_sq_data
>    io_sq_thread_finish
>    io_ring_ctx_free
>    io_ring_exit_work

I've started seeing this issue on my debug kernels.

Not sure if this is the right approach to fix it, but, I've tested this
patch, and the warning went away.

Jens, feel free to add my `Tested-by: Breno Leitao <leitao@debian.org>'
if you decide to get this patch in.

--breno

Re: [PATCH] io_uring/sqpoll: don't set IO_SQ_THREAD_SHOULD_STOP on thread exit

[Jens Axboe]

On 11/3/26 6:09 AM, Breno Leitao wrote:
> On Mon, Nov 02, 2026 at 04:05:42PM +0800, Shuai Liu wrote:
>>   WARNING: io_uring/sqpoll.c:88 at io_sq_thread_stop
>>   Workqueue: iou_exit io_ring_exit_work
>>   Call Trace:
>>    io_put_sq_data
>>    io_sq_thread_finish
>>    io_ring_ctx_free
>>    io_ring_exit_work
> 
> I've started seeing this issue on my debug kernels.
> 
> Not sure if this is the right approach to fix it, but, I've tested this
> patch, and the warning went away.
> 
> Jens, feel free to add my `Tested-by: Breno Leitao <leitao@debian.org>'
> if you decide to get this patch in.

Thanks for testing - I'll get this queued up, but heads-up to the
original submitter, I'm going to trim the comment. LLM's love
their lengthy comments...

-- 
Jens Axboe

Re: [PATCH] io_uring/sqpoll: don't set IO_SQ_THREAD_SHOULD_STOP on thread exit

[Jens Axboe]

On Mon, 02 Nov 2026 16:05:42 +0800, Shuai Liu wrote:
> io_sq_thread_stop() carries a WARN_ON_ONCE() asserting that
> IO_SQ_THREAD_SHOULD_STOP isn't set yet, i.e. that stopping the SQPOLL
> thread is never attempted twice. Since commit 22d9db9fd64a
> ("io_uring/sqpoll: don't attach to a thread that is canceling"), the
> SQPOLL thread itself sets that bit on its way out, so that
> io_sq_offload_create() won't attach a new ring to a thread that is
> canceling.
> 
> [...]

Applied, thanks!

[1/1] io_uring/sqpoll: don't set IO_SQ_THREAD_SHOULD_STOP on thread exit
      commit: fca3ff9e2eee7d285585daf51942e0b5e2be354a

Best regards,
-- 
Jens Axboe