From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Sun, 19 Jul 2026 16:24:32 +0000 (-0700)
Subject: Merge tag 'io_uring-7.2-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git... 
X-Git-Tag: v7.2-rc4~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a2b81de43ca64832fe09844bbf97d1251115d80f;p=thirdparty%2Fkernel%2Fstable.git

Merge tag 'io_uring-7.2-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull io_uring fixes from Jens Axboe:

 - Fix a use-after-free in the bpf-ops struct_ops path, where the same
   io_uring_bpf_ops map could be registered more than once.

 - Fix the deferred iovec free for the provided-buffer grow path, which
   could leave the caller with a dangling iovec and result in repeated
   frees. Follow-up to the earlier fix in this series.

 - Zero-check the unused addr3/pad2 SQE fields for unlinkat

* tag 'io_uring-7.2-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring/bpf-ops: reject re-registration of an already-bound ops
  io_uring/fs: check unused sqe fields for unlinkat
  io_uring/kbuf: free the replaced iovec after a successful grow
---

a2b81de43ca64832fe09844bbf97d1251115d80f