diff --git a/fs/io_uring.c b/fs/io_uring.c
index 353604296e7da80bfdb94d724b6b74828df3431b..5453d1842e2bf3f6f6ec9a4cbf5a987332066bb1 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -2085,7 +2085,9 @@ static void io_req_task_cancel(struct callback_head *cb)
 	struct io_kiocb *req = container_of(cb, struct io_kiocb, task_work);
 	struct io_ring_ctx *ctx = req->ctx;
 
+	mutex_lock(&ctx->uring_lock);
 	__io_req_task_cancel(req, -ECANCELED);
+	mutex_unlock(&ctx->uring_lock);
 	percpu_ref_put(&ctx->refs);
 }
 
@@ -6133,7 +6135,11 @@ static struct io_wq_work *io_wq_submit_work(struct io_wq_work *work)
 	/* if NO_CANCEL is set, we must still run the work */
 	if ((work->flags & (IO_WQ_WORK_CANCEL|IO_WQ_WORK_NO_CANCEL)) ==
 				IO_WQ_WORK_CANCEL) {
-		ret = -ECANCELED;
+		/* io-wq is going to take down one */
+		refcount_inc(&req->refs);
+		percpu_ref_get(&req->ctx->refs);
+		io_req_task_work_add_fallback(req, io_req_task_cancel);
+		return io_steal_work(req);
 	}
 
 	if (!ret) {