kernel/git/next/linux-next.git/io_uring/io_uring.c, branch master

io_uring: wait for in-flight requests on ring release

2026-09-10T17:58:33+00:00

With cancelations now run at release time, what's left in-flight on the ring afterwards is mostly I/O that has already been issued to a device and just needs to finish. Until that happens, the files from those requests pin the files they were using. Wait for those. Signed-off-by: Jens Axboe

io_uring: drop registered files and buffers at release time

2026-09-10T17:58:33+00:00

Registered file and buffer tables are only torn down from io_ring_ctx_free(), which only runs when all requests have completed and the ctx refs have hit zero. Before this, every registered file remains open. The resource nodes are reference counted and any request using a registered file or buffer holds its own reference to the node, so this only releases what is actually unused. The rest follow as those requests complete or get canceled. Signed-off-by: Jens Axboe

io_uring: run cancelations synchronously on ring release

2026-09-10T17:58:33+00:00

io_uring_release() just marks the ring as dying and punts everything else to exit_work, including the cancelation of requests that are easily cancelable right away Until that work has run, and the task_work it generates has as well, those requests keep their files pinned. An application that closes its ring and then expects the files it had been using to be closed as well may be confused by this currently not being the case. Re-factor the cancelation pass out of io_ring_exit_work() and run it directly from release, before punting the rest. Signed-off-by: Jens Axboe

io_uring/cancel: cancel and wait for all requests on process exit

2026-09-10T17:58:33+00:00

When a task exits, io_uring only cancels and waits for the few request types that must not outlive it, and leaves everything else to be torn down whenever the ring itself goes away. This happens from a kernel workqueue, and may be some time after the final fput of the ring has been completed. This sometimes causes application issues, where a task that was doing IO on a file in /mnt, for example, will leave /mnt busy for a brief period of time after close(ring_fd) is done. If the whole thread group is exiting, no thread is left to reap completions or care about those requests. For this case, tear everything down. This is basically what exec does today. Two types of requests are ignored, as they never pin any files and will always complete on their own. One is armed timeouts, which may still be required to trigger if a ring is being shared, and the other is SEND_ZC notifications, which can take almost an unbounded time to complete. io_uring_try_cancel_requests() now takes flags to manage that behavior. While in there, fix up the wait loop for the exit case. A task that is exiting because of a fatal signal still has that signal pending, which turns the interruptible sleep into a busy loop. Use short uninterruptible sleeps in that case instead, task_work still gets run in between. Signed-off-by: Jens Axboe

io_uring: put request files before posting the completions

2026-09-10T17:58:33+00:00

The batch flush posts the CQEs first and drops the files afterwards, with a plain fput() that defers the release to task_work. For the submitting task that runs on the way back to userspace, but with SQPOLL the sqpoll thread only gets to it after the io_uring task_work is done. Userspace sees the CQE in between, and closing the file and exec'ing it fails with ETXTBSY as the request still holds it. Drop the files synchronously before the CQEs are posted, for requests that the flush is about to free. Ring files stay deferred, releasing one takes its uring_lock and may wait on its requests. Signed-off-by: Jens Axboe

io_uring/rw: don't reap io-wq IOPOLL completions while io-wq has a reference

2026-09-10T17:58:33+00:00

IOPOLL requests issued from io-wq are reaped by io_do_iopoll() on the submitter, with the same window as the task_work completions: the CQE is posted while the worker may still hold its reference, and the file is only dropped once it does. Leave such a request on the iopoll list until the worker has dropped its reference, the next pass then reaps it and the put from io_free_batch_list() is the last one. Also move the reference handling for the task_work case into a helper. Signed-off-by: Jens Axboe

io_uring: post io-wq completions from the last request reference

2026-09-10T17:58:32+00:00

io-wq holds a reference on a request for the duration of the issue, as the completion may run before the issue returns. If it does, the CQE is posted from that completion while the worker still holds its reference, and the file is only put once the worker drops it. That means the actual file put happens potentially long after CQE posting. Post the completion with the last put for refcounted requests. io_free_req() no longer marks the request as CQE_SKIP, that is now done by whoever posted the CQE while another reference was still held. Signed-off-by: Jens Axboe

io_uring/io-wq: put the request file before posting a completion

2026-09-10T14:02:14+00:00

Once io-wq is done with the request, put any potential file that request had pinned upfront. This ensures any file references are fully put by the time io-wq posts a completion. Registered files are held by the resource node and don't need this. Signed-off-by: Jens Axboe

Merge tag 'fuse-update-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse

2026-08-25T14:59:44+00:00

Pull fuse updates from Miklos Szeredi: - Improve performance of the io-uring transport by introducing buffer pools and zero-copy (Joanne) - Fix lots of bugs (Baokun Li) - Fix io-uring initialization issues (Joanne, Bernd) - More prep work for large folios (Joanne) - Don't limit buffered read to 128k (Jim Harris) - Fix zeroing of page end (dirtied with mmap) on file size extension (Jimmy Zuber) - Improve performance in certain cases with wake_up_sync() when queuing request (Xuewen Yan) - Misc fixes and cleanups (Xuewen Yan) * tag 'fuse-update-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: (35 commits) fuse: zero the partial EOF page when extending a file io_uring: Add missing include for ITER_SOURCE and ITER_DEST fuse: Fix the condition to enable over-io-uring fuse: invalidate the correct range after O_APPEND direct write selftests/fuse: test post-EOF page zeroing when a file is extended fuse: wake one waiter per freed slot when raising max_background fuse: use min_not_zero() in fuse_init_server_timeout() fuse: copy request headers via a stack buffer for io-uring fuse: give wakeup hints to the scheduler for synchronous requests fuse: check for NULL root inode in fuse_fill_super_submount fuse: reject a duplicate fd= mount option cuse: wait for pending RCU callbacks on module exit fuse: fix invalidate lock leak on open O_TRUNC DAX failure fuse: fix invalidate lock leak on setattr writeback failure fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free fuse: make dentry_tree_work static docs: fuse: document io-uring buffer pool and zero-copy uapi fuse: add zero-copy over io-uring fuse: support registered buffer pools in io-uring fuse: add io-uring buffer pools ...

io_uring/rsrc: rename and export IO_IMU_DEST / IO_IMU_SOURCE

2026-08-17T15:02:10+00:00

Rename IO_IMU_DEST and IO_IMU_SOURCE to IO_BUF_DEST and IO_BUF_SOURCE and export it so subsystems may use it. This is needed by the io_buffer_register_bvec() path for callers who may need the buffer to be both readable and writable. Signed-off-by: Joanne Koong Link: https://patch.msgid.link/20260612184840.4058966-5-joannelkoong@gmail.com Signed-off-by: Jens Axboe Signed-off-by: Miklos Szeredi