[GIT PULL] io_uring fixes for 7.1-rc5

Hi Linus,

A few fixes for io_uring that should go into the 7.1 kernel release.
This pull request contains:

- Fix for an issue with IORING_OP_NOP and using injection results

- Fix for an issue in IORING_OP_WAITID, where the info state was assumed
  cleared by the lower level syscall handler, but for some cases it is
  not. Just clear the data upfront, so that non-initialized data isn't
  copied back to userspace.

- Fix for a lockdep reported issue, where IORING_OP_BIND enters file
  create and hence hits mnt_want_write(), which creates a 3 part lockdep
  cycle between the super lock, io_uring's uring_lock, and the cred
  mutex.

- Fix a regression introduced in this cycle with how linked timeouts are
  deleted.

- Ensure that the ->opcode nospec indexing on the opcode issue side
  covers all the cases.

Please pull!


The following changes since commit f44d38a31f1802b7222adaea9ee69f9d280f698a:

  io_uring: validate user-controlled cq.head in io_cqe_cache_refill() (2026-05-13 21:44:57 -0600)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux.git tags/io_uring-7.1-20260522

for you to fetch changes up to e97ff8b62d4690c69297f0f6de874f0564cc01a4:

  io_uring/nop: pass all errors to userspace (2026-05-21 11:10:56 -0600)

----------------------------------------------------------------
io_uring-7.1-20260522

----------------------------------------------------------------
Alexander A. Klimov (1):
      io_uring/nop: pass all errors to userspace

Heechan Kang (1):
      io_uring/waitid: clear waitid info before copying it to userspace

Jens Axboe (2):
      io_uring/net: punt IORING_OP_BIND async if it needs file create
      io_uring/timeout: splice timed out link in timeout handler

Michael Bommarito (1):
      io_uring: propagate array_index_nospec opcode into req->opcode

 io_uring/io_uring.c |  9 ++++-----
 io_uring/net.c      | 26 +++++++++++++++++++++++++-
 io_uring/nop.c      |  4 ++--
 io_uring/timeout.c  |  4 +++-
 io_uring/waitid.c   |  1 +
 5 files changed, 35 insertions(+), 9 deletions(-)

-- 
Jens Axboe