Merge tag 'io_uring-7.2-20260731' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull io_uring fixes from Jens Axboe:

 - Fix for a bug in how length caps are handled in multishot, and along
   with it, a generic fix for avoiding these kinds of conversion issues
   in the future.

 - Ensure that task restrictions are always preserved across exec.

 - Revert of the io_uring controlled epoll restriction, which disallowed
   nested contexts. Turns out that libuv is already using it like that,
   so we cannot simply remove it, sadly.

 - Fix for a reference leak in the zcrx code.

* tag 'io_uring-7.2-20260731' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring: preserve task restrictions across exec
  io_uring/zcrx: don't clear master_ctx from the import path
  Revert "io_uring/epoll: disallow adding an epoll file to an epoll context"
  io_uring/kbuf: cap buffer selection length at MAX_RW_COUNT
  io_uring/net: initialize mshot_len for send

7 files changed, 15 insertions, 7 deletions

diff --git a/io_uring/cancel.c b/io_uring/cancel.c
index 8c6fa6f367e4..7d7820eab878 100644
--- a/io_uring/cancel.c
+++ b/io_uring/cancel.c
@@ -660,6 +660,6 @@ end_wait:
 		 */
 		atomic_dec(&tctx->in_cancel);
 		/* for exec all current's requests should be gone, kill tctx */
-		__io_uring_free(current);
+		io_uring_free_tctx(current);
 	}
 }
diff --git a/io_uring/epoll.c b/io_uring/epoll.c
index eecd748cad01..b9db8bde27ec 100644
--- a/io_uring/epoll.c
+++ b/io_uring/epoll.c
@@ -62,9 +62,6 @@ int io_epoll_ctl(struct io_kiocb *req, unsigned int issue_flags)
 	CLASS(fd, tf)(ie->fd);
 	if (fd_empty(tf))
 		return -EBADF;
-	/* disallow adding an epoll context to another epoll context */
-	if (ie->op == EPOLL_CTL_ADD && is_file_epoll(fd_file(tf)))
-		return -EINVAL;
 
 	key.file = fd_file(tf);
 	key.fd = ie->fd;
diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
index de0129bceaba..1cf5be62bb65 100644
--- a/io_uring/kbuf.c
+++ b/io_uring/kbuf.c
@@ -266,6 +266,9 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg,
 	if (unlikely(!nr_avail))
 		return -ENOBUFS;
 
+	/* MAX_RW_COUNT is the universal Linux per-call IO maximum */
+	arg->max_len = min_t(size_t, arg->max_len, MAX_RW_COUNT);
+
 	buf = io_ring_head_to_buf(br, head, bl->mask);
 	if (arg->max_len) {
 		u32 len = READ_ONCE(buf->len);
@@ -295,7 +298,7 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg,
 
 	/* set it to max, if not set, so we can use it unconditionally */
 	if (!arg->max_len)
-		arg->max_len = INT_MAX;
+		arg->max_len = MAX_RW_COUNT;
 
 	req->buf_index = READ_ONCE(buf->bid);
 	do {
diff --git a/io_uring/net.c b/io_uring/net.c
index 00a7df803b99..a74d15f7b7d2 100644
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -445,6 +445,7 @@ int io_sendmsg_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 		req->flags |= REQ_F_NOWAIT;
 	if (req->flags & REQ_F_BUFFER_SELECT)
 		sr->buf_group = req->buf_index;
+	sr->mshot_total_len = sr->mshot_len = 0;
 	if (sr->flags & IORING_RECVSEND_BUNDLE) {
 		if (req->opcode == IORING_OP_SENDMSG)
 			return -EINVAL;
diff --git a/io_uring/tctx.c b/io_uring/tctx.c
index cc3bf2b3bdbc..466b7300e208 100644
--- a/io_uring/tctx.c
+++ b/io_uring/tctx.c
@@ -43,7 +43,7 @@ static struct io_wq *io_init_wq_offload(struct io_ring_ctx *ctx,
 	return io_wq_create(concurrency, &data);
 }
 
-void __io_uring_free(struct task_struct *tsk)
+void io_uring_free_tctx(struct task_struct *tsk)
 {
 	struct io_uring_task *tctx = tsk->io_uring;
 	struct io_tctx_node *node;
@@ -67,6 +67,11 @@ void __io_uring_free(struct task_struct *tsk)
 		kfree(tctx);
 		tsk->io_uring = NULL;
 	}
+}
+
+void __io_uring_free(struct task_struct *tsk)
+{
+	io_uring_free_tctx(tsk);
 	if (tsk->io_uring_restrict) {
 		io_put_bpf_filters(tsk->io_uring_restrict);
 		kfree(tsk->io_uring_restrict);
diff --git a/io_uring/tctx.h b/io_uring/tctx.h
index 2310d2a0c46d..76ad1ad4594e 100644
--- a/io_uring/tctx.h
+++ b/io_uring/tctx.h
@@ -12,6 +12,7 @@ void io_uring_del_tctx_node(unsigned long index);
 int __io_uring_add_tctx_node(struct io_ring_ctx *ctx);
 int __io_uring_add_tctx_node_from_submit(struct io_ring_ctx *ctx);
 void io_uring_clean_tctx(struct io_uring_task *tctx);
+void io_uring_free_tctx(struct task_struct *tsk);
 
 void io_uring_unreg_ringfd(void);
 int io_ringfd_register(struct io_ring_ctx *ctx, void __user *__arg,
diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index 76b9b0d54af9..f1464ea8ca64 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -808,7 +808,8 @@ err_xa_erase:
 	scoped_guard(mutex, &ctx->mmap_lock)
 		xa_erase(&ctx->zcrx_ctxs, id);
 err:
-	zcrx_unregister(ifq, ctx);
+	/* the import path never set the ->master_ctx ref, don't drop it */
+	zcrx_unregister(ifq, NULL);
 	return ret;
 }