Merge tag 'io_uring-7.4-20261106' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull io_uring fixes from Jens Axboe:

 - Only wait for in-flight requests on ring release if the closing task
   actually uses the ring.

 - SQPOLL fixes: do the return-to-userspace work in the SQPOLL thread,
   as memory.high reclaim and blkcg throttling otherwise only ran at
   thread exit, and don't set the stop bit on thread exit, which tripped
   a WARN_ON_ONCE() in the ring teardown.

 - Don't poll a writer for a read side hangup or for urgent data, as a
   half-closed peer or unread OOB data kept the async poll of a send
   ready on every re-arm.

 - Cancel all matching poll requests in one pass for CANCEL_ALL rather
   than restarting the hash walk per request.

 - Hold uring_lock across the put_user() for the index-alloc file
   install.

 - Don't arm an hrtimer and schedule for a wait whose timeout has
   already expired.

 - Add a feature flag for the dma-buf registered buffer support.

 - selftests 32-bit cast fix

* tag 'io_uring-7.4-20261106' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring: only wait for in-flight requests if the closing task uses the ring
  io_uring: add feature flag for dma-buf support
  io_uring/wait: don't sleep on an already expired timeout
  io_uring/rsrc: hold uring_lock across index-alloc put_user
  selftests/io_uring: cast optval through uintptr_t in mini_liburing.h
  io_uring/poll: don't poll a writer for urgent data
  io_uring/poll: don't poll a writer for a read side hangup
  io_uring/poll: cancel all matching requests in one pass
  io_uring/cancel: count all requests that a CANCEL_ALL cancels
  io_uring/sqpoll: do the return-to-userspace work in the SQPOLL thread
  io_uring/sqpoll: don't set IO_SQ_THREAD_SHOULD_STOP on thread exit

1 files changed, 1 insertions, 0 deletions

diff --git a/include/uapi/linux/io_uring.h b/include/uapi/linux/io_uring.h
index b456f45fa8de..cf1afd11bb87 100644
--- a/include/uapi/linux/io_uring.h
+++ b/include/uapi/linux/io_uring.h
@@ -646,6 +646,7 @@ struct io_uring_params {
 #define IORING_FEAT_MIN_TIMEOUT		(1U << 15)
 #define IORING_FEAT_RW_ATTR		(1U << 16)
 #define IORING_FEAT_NO_IOWAIT		(1U << 17)
+#define IORING_FEAT_REGBUF_TYPES	(1U << 18)
 
 /*
  * io_uring_register(2) opcodes and arguments