Merge tag 'io_uring-7.4-20261029' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull io_uring fixes from Jens Axboe:

 - A batch of fixes from Chris:
    - Charge registered buffer arrays, rsrc nodes, tctx nodes and
      personalities to memcg, and free the XArray nodes a failed store
      leaves behind.
    - Clear bpf_ctx while submitting SQEs from a bpf-ops program, as the
      socket code otherwise skips both the capability check and
      lock_sock() for a setsockopt from the SQ.
    - Free the task context after an RCU grace period, closing a UAF
      when a foreign task frees the last request.
    - Stop io_ring_exit_work() from waiting on an SQPOLL thread held in
      get_signal(), and drop sqd->lock while the thread waits for
      in-flight requests, as either one could pin every iou_exit slot

 - io-wq fixes:
    - Don't create new workers once the exit has begun, which could
      leave an exiting worker in the thread group under exec
    - save the worker type before dropping its reference (KASAN UAF)
    - Defer io-wq enqueues from a foreign task to task_work, as an
      IOPOLL reap by another task could race io_wq_put_and_exit()

 - Keep the drain active when the deferred request being started is
   itself a drain request, and don't attach a new ring to an SQPOLL
   thread that is already canceling

 - Fix the multishot recv length limit accounting, and count cancelled
   timeouts in cq_timeouts so an armed off timeout doesn't fire early

 - Advance the buffer ring head when a pickup empties it, and keep the
   recvmsg buffer select length within MAX_RW_COUNT

 - Mask the socket type in the bpf filter population so SOCK_CLOEXEC or
   SOCK_NONBLOCK can't bypass a type filter, and enforce the per-task
   register restrictions for blind registration

 - Complete a non-blocking connect() that fails with -EAGAIN rather than
   retrying it through poll and io-wq, matching connect(2)

 - napi list traversal cleanup, and remove a useless min_not_zero()

* tag 'io_uring-7.4-20261029' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (21 commits)
  io_uring/sqpoll: don't attach to a thread that is canceling
  io_uring/net: fix multishot recv length limit accounting
  io_uring/timeout: count cancelled timeouts in cq_timeouts
  io_uring/napi: clean up list traversal with list_for_each_entry_safe()
  io_uring: defer foreign io-wq enqueues to task_work
  io_uring/io-wq: save worker type before dropping its reference
  io_uring/cancel: drop sqd->lock while SQPOLL waits
  io_uring/sqpoll: don't wait for the thread to exit
  io_uring: free the task context after a grace period
  io_uring/bpf-ops: clear bpf_ctx while submitting SQEs
  io_uring: free XArray nodes left by a failed store
  io_uring: charge tctx nodes and personalities
  io_uring/rsrc: charge buffer arrays and nodes to memcg
  io_uring/io-wq: no new workers once the exit has begun
  io_uring: keep the drain active when a deferred drain request is started
  io_uring/net: don't retry a non-blocking connect() that fails with -EAGAIN
  io_uring/register: enforce per-task restrictions in io_uring_register_blind()
  io_uring/net: mask socket type with SOCK_TYPE_MASK in io_socket_bpf_populate()
  io_uring/net: Remove useless min_not_zero() usage
  io_uring/net: keep recvmsg buffer select length within MAX_RW_COUNT
  ...

0 files changed, 0 insertions, 0 deletions