Merge tag 'io_uring-6.17-20250822' of git://git.kernel.dk/linux

Pull io_uring fixes from Jens Axboe:
 "Just two small fixes - one that fixes inconsistent ->async_data vs
  REQ_F_ASYNC_DATA handling in futex, and a followup that just ensures
  that if other opcode handlers mess this up, it won't cause any issues"

* tag 'io_uring-6.17-20250822' of git://git.kernel.dk/linux:
  io_uring: clear ->async_data as part of normal init
  io_uring/futex: ensure io_futex_wait() cleans up properly on failure

Author: torvalds

io_uring/futex.c

@@ -288,6 +288,7 @@ int io_futex_wait(struct io_kiocb *req, unsigned int issue_flags)
 		goto done_unlock;
 	}
 
+	req->flags |= REQ_F_ASYNC_DATA;
 	req->async_data = ifd;
 	ifd->q = futex_q_init;
 	ifd->q.bitset = iof->futex_mask;
@@ -309,6 +310,8 @@ int io_futex_wait(struct io_kiocb *req, unsigned int issue_flags)
 	if (ret < 0)
 		req_set_fail(req);
 	io_req_set_res(req, ret, 0);
+	req->async_data = NULL;
+	req->flags &= ~REQ_F_ASYNC_DATA;
 	kfree(ifd);
 	return IOU_COMPLETE;
 }

io_uring/io_uring.c

@@ -2119,6 +2119,7 @@ static int io_init_req(struct io_ring_ctx *ctx, struct io_kiocb *req,
 	req->file = NULL;
 	req->tctx = current->io_uring;
 	req->cancel_seq_set = false;
+	req->async_data = NULL;
 
 	if (unlikely(opcode >= IORING_OP_LAST)) {
 		req->opcode = 0;