With IORING_ASYNC_CANCEL_ALL, __io_async_cancel() calls io_try_cancel() until it finds nothing more and adds 1 to the count for each call that found something, which is correct for poll, io-wq and timeouts, which cancel one request per call. io_futex_cancel() and io_waitid_cancel() cancel all matches in a single call and return how many they canceled. Three futex waits with the same user_data are all canceled by the first call, which counts as one, and the cancel completes with 1, not 3. Sum the return values of io_try_cancel() instead, so that the count is the number of canceled requests, as io_uring_prep_cancel(3) documents. Fixes: 194bb58c6090 ("io_uring: add support for futex wake and wait") Fixes: f31ecf671ddc ("io_uring: add IORING_OP_WAITID support") Signed-off-by: agxr --- io_uring/cancel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/io_uring/cancel.c b/io_uring/cancel.c index 6f7a6cf356c2..e4b27b79b05c 100644 --- a/io_uring/cancel.c +++ b/io_uring/cancel.c @@ -198,7 +198,7 @@ static int __io_async_cancel(struct io_cancel_data *cd, break; if (!all) return ret; - nr++; + nr += ret > 0 ? ret : 1; } while (1); /* slow path, try all io-wq's */ -- 2.56.0