From: Jens Axboe <axboe@kernel.dk>
To: Pavel Begunkov <asml.silence@gmail.com>,
syzbot <syzbot+6456a99dfdc2e78c4feb@syzkaller.appspotmail.com>,
io-uring@vger.kernel.org, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [io-uring?] BUG: unable to handle kernel NULL pointer dereference in io_buffer_select
Date: Mon, 12 May 2025 08:19:47 -0600 [thread overview]
Message-ID: <69ae835b-89b2-44bf-b51c-c365d89dbb45@kernel.dk> (raw)
In-Reply-To: <991ce8af-860b-41ec-9347-b5733d8259fe@gmail.com>
On 5/12/25 8:19 AM, Pavel Begunkov wrote:
> On 5/12/25 14:56, Jens Axboe wrote:
>> On 5/11/25 6:22 AM, Pavel Begunkov wrote:
>>> On 5/11/25 01:19, syzbot wrote:
> ...>> this line:
>>>
>>> tail = smp_load_acquire(&br->tail);
>>>
>>> The offset of the tail field is 0xe so bl->buf_ring should be 0. That's
>>> while it has IOBL_BUF_RING flag set. Same goes for the other report. Also,
>>> since it's off io_buffer_select(), which looks up the list every time we
>>> can exclude the req having a dangling pointer.
>>
>> It's funky for sure, the other one is regular classic provided buffers.
>> Interestingly, both reports are for arm32...
>
> The other is ring pbuf as well
True yes, both are pbuf. I can't hit any of this on arm64 or x86-64, fwiw.
Which is why I thought the arm32 connection might be interesting. Not that
the arch should matter at all here, but...
--
Jens Axboe
next prev parent reply other threads:[~2025-05-12 14:19 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-05-11 0:19 [syzbot] [io-uring?] BUG: unable to handle kernel NULL pointer dereference in io_buffer_select syzbot
2025-05-11 12:22 ` Pavel Begunkov
2025-05-12 13:56 ` Jens Axboe
2025-05-12 14:19 ` Pavel Begunkov
2025-05-12 14:19 ` Jens Axboe [this message]
2025-05-12 14:29 ` Pavel Begunkov
2025-05-12 14:57 ` Jens Axboe
2025-05-12 15:24 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=69ae835b-89b2-44bf-b51c-c365d89dbb45@kernel.dk \
--to=axboe@kernel.dk \
--cc=asml.silence@gmail.com \
--cc=io-uring@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzbot+6456a99dfdc2e78c4feb@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox