[GIT PULL] io_uring updates and fixes for 7.4-rc

[Jens Axboe <axboe@kernel.dk>]

Hi Linus,

The bulk of this is a big robustness pass over cancelation, io-wq,
timeouts, and poll. Outside of that:

- Large series from Josef hardening the cancelation, io-wq, timeout,
  poll, and wait paths. Fixes for lost wakeups and lost cancels as io-wq
  arms poll/timeouts, work stranding on worker exit, CQE32 resize
  handling, napi entry timeouts, and a pile of smaller correctness
  issues across the board.

- Rework of how io-wq posts completions, posting from the last request
  reference and dropping the request file before the completion, and
  running ring release cancelations synchronously - canceling and
  waiting for all in-flight requests and dropping registered files and
  buffers at release time.

- Don't charge the SQ/CQ rings or provided buffer rings to
  RLIMIT_MEMLOCK, which the region API conversion had started doing.

- Split io_uring_cmd_set_res() out from io_uring_cmd_done() so a command
  can set the result from its ->end_io() handler, used by nvme.

- CQE32 ring fixes for the free entry check, aux CQE big_cqe zeroing,
  and the dummy skip CQE.

- Timeout fixes for sequence handling and multishot updates.

- net fixes for MSG_TRUNC buffer overconsumption and keeping recv buffer
  select length within MAX_RW_COUNT.

- Wake real-time waiters from hard interrupt context.

- Don't spin on local work an exiting task can't run, reachable by an
  unprivileged user.

- Various other fixes and cleanups.

Please pull!


The following changes since commit df2908090cda368b01ff43709f51890076c56157:

  Linux 7.3-rc2 (2026-09-06 15:07:20 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux.git tags/for-7.4/io_uring-20261021

for you to fetch changes up to ecb6817b769fd7d71af2c9f446188649020b2e53:

  io_uring: end the drain when the drain request completes (2026-10-20 08:35:27 -0600)

----------------------------------------------------------------
for-7.4/io_uring-20261021

----------------------------------------------------------------
Austin Schuh (2):
      io_uring/wait: wake real-time waiters from hard interrupt context
      io_uring/futex: return a wait's data to the cache when it fails to arm

Caleb Sander Mateos (4):
      io_uring/rw: keep CQE flags on iopoll requests when adding kbuf flags
      io_uring: move req_set_*() to public header
      io_uring/cmd: split io_uring_cmd_set_res() from io_uring_cmd_done()
      nvme/ioctl: call io_uring_cmd_set_res32() in ->end_io()

Cen Zhang (Microsoft Security FORGE Labs) (1):
      io_uring/cancel: don't spin on local work the task can't run

Christoph Hellwig (2):
      io_uring: cleanup __io_prep_rw
      io_uring: cleanup the io_uring_attr_pi definition

David Wei (1):
      io_uring/memmap: fix non-compound alloc fallback with memcg accounting

Eugene Gvozdetsky (1):
      io_uring/register: don't exempt disabled rings from task restrictions

Gabriel Krisman Bertazi (2):
      io_uring/net: let io_recv_buf_select return the length of the buffer region
      io_uring/net: don't overconsume buffers when using MSG_TRUNC

Hengyu Liang (1):
      io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK

Hui Peng (6):
      io_uring/bpf_filter: mark source as COW when cloning filters
      io_uring: only post the dummy skip CQE on CQE_MIXED rings
      io_uring: fix free entry check for 32b CQEs on CQE32 rings
      io_uring: zero big_cqe for aux CQEs on CQE32 rings
      io_uring: check for room before posting the dummy skip CQE
      io_uring/rsrc: fix accounting for cloned buffers with huge pages

Jann Horn (1):
      io_uring/fdinfo: ignore IORING_CQE_F_32 in last CQ array slot

Jens Axboe (20):
      io_uring/rw: end write accounting from ->ki_complete
      Merge branch 'io_uring-7.3' into for-7.4/io_uring
      io_uring/io-wq: put the request file before posting a completion
      io_uring: post io-wq completions from the last request reference
      io_uring/rw: don't reap io-wq IOPOLL completions while io-wq has a reference
      io_uring: put request files before posting the completions
      io_uring/uring_cmd: only cancel requests of the given task
      io_uring/notif: count pending zerocopy notifications per ring
      io_uring/cancel: cancel and wait for all requests on process exit
      io_uring: run cancelations synchronously on ring release
      io_uring: drop registered files and buffers at release time
      io_uring: wait for in-flight requests on ring release
      io_uring: fix task_work add use-after-free with SQPOLL
      io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK
      Merge branch 'io_uring-7.3' into for-7.4/io_uring
      io_uring/timeout: don't put a sequence target behind the last flush
      io_uring/timeout: don't flush with the sequence behind the last flush
      io_uring/timeout: don't lose a cancel as io-wq arms a timeout
      io_uring/poll: don't loop on HUP with multiple references
      io_uring: end the drain when the drain request completes

Josef Bacik (43):
      io_uring/waitid: own the request before clearing ->head
      io_uring/cmd: don't leave list poison in ->hash_node
      io_uring/wait: don't spin on a stuck overflow list
      io_uring/io-wq: don't lose the signal that ends work
      io_uring/io-wq: don't hide a link from cancellations
      io_uring: don't flood a cancelling task with task_work
      io_uring: don't lose the DEFER_TASKRUN wake up
      io_uring/cancel: rearm local work wake up before sleep
      io_uring/mpscq: disable preemption while pushing
      io_uring/io-wq: don't go to sleep on pending work
      io_uring/io-wq: don't strand work when a worker exits
      io_uring/io-wq: don't exit with a creation pending
      io_uring/io-wq: let cancel find picked up hashed work
      io_uring/poll: don't lose a cancel as io-wq arms poll
      io_uring: don't lose a cancel as io-wq parks a request
      io_uring/cancel: don't forget that the work was running
      io_uring/cancel: recognize "no timeout" on 32-bit
      io_uring/cancel: let CANCEL_ALL find parked requests
      io_uring: wake ring pollers for local task_work
      io_uring/wait: look at all CQ waiters on wake up
      io_uring/poll: drop stale double poll entry on rearm
      io_uring/futex: allocate private hash before waiting
      io_uring: drop the CQE cache if a refill fails
      io_uring: don't split 128b SQEs at the SQPOLL cap
      io_uring/register: don't wrap 32b CQEs when resizing
      io_uring/register: handle index wrap when resizing
      io_uring/register: keep 128b SQEs intact on resize
      io_uring/fdinfo: fix CQE dump of CQE32 rings
      io_uring/timeout: don't skip over reached sequences
      io_uring/timeout: keep repeat count on multishot update
      io_uring/timeout: use the right clock for ABS updates
      io_uring/wait: no early -ETIME if min_wait finds work
      io_uring/napi: make stale entries time out after 60s
      io_uring/napi: don't busy poll past an expired timeout
      io_uring/zcrx: fix buffer offsets in areas above 4GB
      io_uring/kbuf: handle index wrap in last buffer check
      io_uring/sqpoll: let the thread sleep on disabled rings
      io_uring/openclose: keep the lock in io_pipe_fixed()
      io_uring: don't pass restart error codes to userspace
      io_uring/net: don't retry recv on uncommitted buffers
      io_uring/timeout: no ABS update of multishot timeouts
      io_uring/timeout: don't end a linked timeout with 1
      io_uring: look up the file before queueing to io-wq

Juanlu Herrero (1):
      io_uring/poll: avoid retry wakeup loss when dropping ownership

Junyeong Lee (1):
      io_uring/waitid: prevent cancel reference wrap

Junyuan Feng (1):
      io_uring/zcrx: requeue multishot receives stopped by a local resource

Natasha Klaus (1):
      io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6

Nickolai Zeldovich (1):
      io_uring/waitid: return -EAGAIN for a non-blocking pidfd

Oleg Nesterov (1):
      io_uring/io-wq: don't call try_to_wake_up() twice in io_wq_worker_wake()

Tamaki Yanagawa (1):
      io_uring/net: keep recv buffer select length within MAX_RW_COUNT

Xiaochuan Li (1):
      io_uring/io-wq: release raw spinlock before calling wake_up()

Yao Kai (1):
      io_uring: initialize task context before running the BPF loop

lollipopkit (1):
      io_uring/cmd_net: end TX_TIMESTAMP multishot when the CQ is full

 drivers/nvme/host/ioctl.c      |  19 +-
 include/linux/io_uring.h       |  32 ++++
 include/linux/io_uring/cmd.h   |  34 +++-
 include/linux/io_uring_types.h |   9 +
 include/uapi/linux/io_uring.h  |  15 +-
 io_uring/bpf_filter.c          |   1 +
 io_uring/cancel.c              | 135 +++++++++++--
 io_uring/cancel.h              |  15 +-
 io_uring/cmd_net.c             |  19 +-
 io_uring/fdinfo.c              |  23 ++-
 io_uring/futex.c               |  38 +++-
 io_uring/io-wq.c               | 138 +++++++++++---
 io_uring/io_uring.c            | 417 ++++++++++++++++++++++++++++++++---------
 io_uring/io_uring.h            |  67 ++++---
 io_uring/kbuf.c                |   8 +-
 io_uring/loop.c                |  13 +-
 io_uring/memmap.c              |  18 +-
 io_uring/memmap.h              |   2 +-
 io_uring/mpscq.h               |  14 +-
 io_uring/napi.c                |   4 +-
 io_uring/net.c                 |  81 ++++++--
 io_uring/notif.c               |   2 +
 io_uring/openclose.c           |  11 +-
 io_uring/poll.c                |  38 +++-
 io_uring/refs.h                |  27 +++
 io_uring/register.c            |  75 +++++++-
 io_uring/rsrc.c                |  42 ++++-
 io_uring/rw.c                  |  74 ++++----
 io_uring/sqpoll.c              |   7 +
 io_uring/timeout.c             | 120 +++++++++---
 io_uring/timeout.h             |   2 +
 io_uring/tw.c                  |  39 +++-
 io_uring/uring_cmd.c           |  25 +--
 io_uring/uring_cmd.h           |   2 +-
 io_uring/wait.c                |  48 +++--
 io_uring/wait.h                |  15 ++
 io_uring/waitid.c              |  23 ++-
 io_uring/zcrx.c                |  13 +-
 38 files changed, 1297 insertions(+), 368 deletions(-)

-- 
Jens Axboe