[GIT PULL] io_uring fixes for 7.2-rc4

[Jens Axboe <axboe@kernel.dk>]

Hi Linus,

A small set of io_uring fixes for this week. This pull request contains:

- Fix a use-after-free in the bpf-ops struct_ops path, where the same
  io_uring_bpf_ops map could be registered more than once.

- Fix the deferred iovec free for the provided-buffer grow path, which
  could leave the caller with a dangling iovec and result in repeated
  frees. Follow-up to the earlier fix in this series.

- Zero-check the unused addr3/pad2 SQE fields for unlinkat

Please pull!


The following changes since commit f3176c8ac4217c88fe1147ab084c47092921ffc4:

  Revert "io_uring: grab RCU read lock marking task run" (2026-07-09 11:43:07 -0600)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux.git tags/io_uring-7.2-20260717

for you to fetch changes up to 3afc64c61ce906a04f073ca350b46de10e8302f9:

  io_uring/bpf-ops: reject re-registration of an already-bound ops (2026-07-17 11:17:54 -0600)

----------------------------------------------------------------
Jaeyeong Lee (1):
      io_uring/kbuf: free the replaced iovec after a successful grow

Woraphat Khiaodaeng (1):
      io_uring/bpf-ops: reject re-registration of an already-bound ops

Yi Xie (1):
      io_uring/fs: check unused sqe fields for unlinkat

 io_uring/bpf-ops.c | 2 ++
 io_uring/fs.c      | 3 ++-
 io_uring/kbuf.c    | 4 ++--
 3 files changed, 6 insertions(+), 3 deletions(-)

-- 
Jens Axboe