[GIT PULL] io_uring fixes for 7.1-rc1

[Jens Axboe <axboe@kernel.dk>]

Hi Linus,

Set of fixes and cleanups for io_uring queued up for the 7.1 kernel
release. This pull request contains:

- Fix for a NOMMU bug with io_uring, where NOMMU doesn't grab page refs
  at mmap time. NOMMU also has entirely broken FOLL_PIN support, yet
  here we are.

- A few fixes covering minor issues introduced in this merge window.

- data race annotation to shut up KCSAN for when io-wq limits are
  applied.

- A nospec addition for direct descriptor file updating. Rest of the
  direct descriptor path already had this, but for some reason the
  update did not. Now they are all the same.

- Various minor defensive changes that claude identified and suggested
  terrible fixes for, turned into actually useful cleanups.
	- Use kvfree() for the imu cache. These can come from kmalloc or
	  vmalloc depending on size, but the in-cache ones are capped
	  where it's always kmalloc based. Change to kvfree() in the
	  cleanup path, making future changes unlikely to mess that up.
	- Negative kbuf consumption lengths. Can't happen right now, but
	  cqe->res is used directly, which if other codes changes could
	  then be an error value.

- Fix for an issue with the futex code, where partial wakes on a
  vectored fuxes would potentially wake the same futex twice, rather
  than move on to the next one. This could confuse an application as it
  would've expected the next futex to have been woken.

- Fix for a bug with ring resizing, where SQEs or CQEs might not have
  been copied correctly if large SQEs or CQEs are used in the ring.
  Application side issue, where SQEs or CQEs might have been lost during
  resize.

- Fix for a bug where EPOLL_URING_WAKE might have been lost, causing a
  multishot poll to not be terminated when it's nested, like it should
  have been.

- Fix for an issue with signed comparison of poll references for the
  slow path.

- Fix for a user struct UAF in the zcrx code.

- Two minor zcrx cleanups.

Please pull!


The following changes since commit 5bdb4078e1efba9650c03753616866192d680718:

  Merge tag 'sched_ext-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext (2026-04-15 10:54:24 -0700)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux.git tags/io_uring-7.1-20260424

for you to fetch changes up to d0be8884f56b0b800cd8966e37ce23417cd5044e:

  io_uring: take page references for NOMMU pbuf_ring mmaps (2026-04-21 20:14:39 -0600)

----------------------------------------------------------------
io_uring-7.1-20260424

----------------------------------------------------------------
Greg Kroah-Hartman (1):
      io_uring: take page references for NOMMU pbuf_ring mmaps

Jens Axboe (10):
      io_uring/tctx: check for setup tctx->io_wq before teardown
      io_uring/tctx: mark io_wq as exiting before error path teardown
      io_uring: fix iowq_limits data race in tctx node addition
      io_uring: fix spurious fput in registered ring path
      io_uring/rsrc: unify nospec indexing for direct descriptors
      io_uring/rsrc: use kvfree() for the imu cache
      io_uring/rw: add defensive hardening for negative kbuf lengths
      io_uring/futex: ensure partial wakes are appropriately dequeued
      io_uring/register: fix ring resizing with mixed/large SQEs/CQEs
      io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE

Longxuan Yu (1):
      io_uring/poll: fix signed comparison in io_poll_get_ownership()

Pavel Begunkov (3):
      io_uring/zcrx: fix user_struct uaf
      io_uring/zcrx: clear RQ headers on init
      io_uring/zcrx: warn on freelist violations

 io_uring/alloc_cache.h |  2 +-
 io_uring/futex.c       |  4 +++-
 io_uring/io_uring.c    |  3 ++-
 io_uring/memmap.c      | 46 +++++++++++++++++++++++++++++++++++++++++++++-
 io_uring/poll.c        |  6 ++++--
 io_uring/register.c    | 36 ++++++++++++++++++++++++++++--------
 io_uring/rsrc.c        |  5 ++++-
 io_uring/rsrc.h        |  9 +++++++--
 io_uring/rw.c          |  4 ++--
 io_uring/tctx.c        | 15 +++++++++++----
 io_uring/zcrx.c        |  5 ++++-
 11 files changed, 111 insertions(+), 24 deletions(-)

-- 
Jens Axboe