Commit fa58e6e9000c for kernel

commit fa58e6e9000c1cc76a7a0c06ea3e68d728cc4247
Merge: b85900e91c84 d0be8884f56b
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Apr 24 15:00:54 2026 -0700

    Merge tag 'io_uring-7.1-20260424' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

    Pull io_uring fixes from Jens Axboe:

     - Fix for a NOMMU bug with io_uring, where NOMMU doesn't grab page refs
       at mmap time. NOMMU also has entirely broken FOLL_PIN support, yet
       here we are

     - A few fixes covering minor issues introduced in this merge window

     - data race annotation to shut up KCSAN for when io-wq limits are
       applied

     - A nospec addition for direct descriptor file updating. Rest of the
       direct descriptor path already had this, but for some reason the
       update did not. Now they are all the same

     - Various minor defensive changes that claude identified and suggested
       terrible fixes for, turned into actually useful cleanups:

           - Use kvfree() for the imu cache. These can come from kmalloc or
             vmalloc depending on size, but the in-cache ones are capped
             where it's always kmalloc based. Change to kvfree() in the
             cleanup path, making future changes unlikely to mess that up

           - Negative kbuf consumption lengths. Can't happen right now, but
             cqe->res is used directly, which if other codes changes could
             then be an error value

     - Fix for an issue with the futex code, where partial wakes on a
       vectored fuxes would potentially wake the same futex twice, rather
       than move on to the next one. This could confuse an application as it
       would've expected the next futex to have been woken

     - Fix for a bug with ring resizing, where SQEs or CQEs might not have
       been copied correctly if large SQEs or CQEs are used in the ring.
       Application side issue, where SQEs or CQEs might have been lost
       during resize

     - Fix for a bug where EPOLL_URING_WAKE might have been lost, causing a
       multishot poll to not be terminated when it's nested, like it should
       have been

     - Fix for an issue with signed comparison of poll references for the
       slow path

     - Fix for a user struct UAF in the zcrx code

     - Two minor zcrx cleanups

    * tag 'io_uring-7.1-20260424' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
      io_uring: take page references for NOMMU pbuf_ring mmaps
      io_uring/poll: ensure EPOLL_ONESHOT is propagated for EPOLL_URING_WAKE
      io_uring/zcrx: warn on freelist violations
      io_uring/zcrx: clear RQ headers on init
      io_uring/zcrx: fix user_struct uaf
      io_uring/register: fix ring resizing with mixed/large SQEs/CQEs
      io_uring/futex: ensure partial wakes are appropriately dequeued
      io_uring/rw: add defensive hardening for negative kbuf lengths
      io_uring/rsrc: use kvfree() for the imu cache
      io_uring/rsrc: unify nospec indexing for direct descriptors
      io_uring: fix spurious fput in registered ring path
      io_uring: fix iowq_limits data race in tctx node addition
      io_uring/tctx: mark io_wq as exiting before error path teardown
      io_uring/tctx: check for setup tctx->io_wq before teardown
      io_uring/poll: fix signed comparison in io_poll_get_ownership()