[GIT PULL] io_uring fixes for 7.4-rc1

[Jens Axboe <axboe@kernel.dk>]

Hi Linus,

A pile of io_uring fixes, that either came in during the merge window,
or just needed a bit more simmering before I was comfortable sending it
all out. This pull request contains:

- A batch of fixes from Chris: charge registered buffer arrays, rsrc
  nodes, tctx nodes and personalities to memcg, and free the XArray
  nodes a failed store leaves behind. Clear bpf_ctx while submitting
  SQEs from a bpf-ops program, as the socket code otherwise skips both
  the capability check and lock_sock() for a setsockopt from the SQ.
  Free the task context after an RCU grace period, closing a UAF when
  a foreign task frees the last request. And stop io_ring_exit_work()
  from waiting on an SQPOLL thread held in get_signal(), and drop
  sqd->lock while the thread waits for in-flight requests, as either
  one could pin every iou_exit slot

- io-wq fixes: don't create new workers once the exit has begun, which
  could leave an exiting worker in the thread group under exec; save
  the worker type before dropping its reference (KASAN UAF); and defer
  io-wq enqueues from a foreign task to task_work, as an IOPOLL reap
  by another task could race io_wq_put_and_exit()

- Keep the drain active when the deferred request being started is
  itself a drain request, and don't attach a new ring to an SQPOLL
  thread that is already canceling

- Fix the multishot recv length limit accounting, and count cancelled
  timeouts in cq_timeouts so an armed off timeout doesn't fire early

- Advance the buffer ring head when a pickup empties it, and keep the
  recvmsg buffer select length within MAX_RW_COUNT

- Mask the socket type in the bpf filter population so SOCK_CLOEXEC or
  SOCK_NONBLOCK can't bypass a type filter, and enforce the per-task
  register restrictions for blind registration

- Complete a non-blocking connect() that fails with -EAGAIN rather
  than retrying it through poll and io-wq, matching connect(2)

- napi list traversal cleanup, and remove a useless min_not_zero()

Please pull!


The following changes since commit 6b4b543fa18757297ac756a6fe6e64f506b7844a:

  Merge tag 'parisc-for-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux (2026-10-25 18:04:17 -1000)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux tags/io_uring-7.4-20261029

for you to fetch changes up to 22d9db9fd64a493525d692b32c556875b7254665:

  io_uring/sqpoll: don't attach to a thread that is canceling (2026-10-30 07:33:00 -0600)

----------------------------------------------------------------
io_uring-7.4-20261029

----------------------------------------------------------------
Anvik Loitongbam (1):
      io_uring/napi: clean up list traversal with list_for_each_entry_safe()

Cheng Yongkang (2):
      io_uring/timeout: count cancelled timeouts in cq_timeouts
      io_uring/net: fix multishot recv length limit accounting

Chris Mason (7):
      io_uring/rsrc: charge buffer arrays and nodes to memcg
      io_uring: charge tctx nodes and personalities
      io_uring: free XArray nodes left by a failed store
      io_uring/bpf-ops: clear bpf_ctx while submitting SQEs
      io_uring: free the task context after a grace period
      io_uring/sqpoll: don't wait for the thread to exit
      io_uring/cancel: drop sqd->lock while SQPOLL waits

Cl?ment L?ger (1):
      io_uring/net: Remove useless min_not_zero() usage

Daan De Meyer (1):
      io_uring/net: don't retry a non-blocking connect() that fails with -EAGAIN

Dominik Maier (2):
      io_uring/net: mask socket type with SOCK_TYPE_MASK in io_socket_bpf_populate()
      io_uring/register: enforce per-task restrictions in io_uring_register_blind()

Jens Axboe (2):
      io_uring: keep the drain active when a deferred drain request is started
      io_uring/sqpoll: don't attach to a thread that is canceling

Josef Bacik (1):
      io_uring/io-wq: no new workers once the exit has begun

Kyle Zeng (2):
      io_uring/io-wq: save worker type before dropping its reference
      io_uring: defer foreign io-wq enqueues to task_work

Yichong Chen (2):
      io_uring/kbuf: advance head when a pickup empties the buffer ring
      io_uring/net: keep recvmsg buffer select length within MAX_RW_COUNT

 include/linux/io_uring_types.h |  3 ++
 io_uring/bpf-ops.c             | 16 ++++++++++-
 io_uring/cancel.c              | 20 ++++++++++++++
 io_uring/io-wq.c               | 14 ++++++++--
 io_uring/io_uring.c            | 50 +++++++++++++++++++++++++++-------
 io_uring/kbuf.c                |  4 ++-
 io_uring/napi.c                | 14 +++-------
 io_uring/net.c                 | 27 ++++++++++++++----
 io_uring/register.c            |  7 +++++
 io_uring/rsrc.c                |  7 +++--
 io_uring/sqpoll.c              | 39 ++++++++++++++++++++++----
 io_uring/sqpoll.h              |  3 +-
 io_uring/tctx.c                |  9 ++++--
 io_uring/timeout.c             |  3 ++
 14 files changed, 172 insertions(+), 44 deletions(-)

-- 
Jens Axboe