Re: [syzbot] [io-uring?] BUG: unable to handle kernel NULL pointer dereference in io_buffer_select

[Pavel Begunkov <asml.silence@gmail.com>]

On 5/12/25 14:56, Jens Axboe wrote:
> On 5/11/25 6:22 AM, Pavel Begunkov wrote:
>> On 5/11/25 01:19, syzbot wrote:
...>> this line:
>>
>> tail = smp_load_acquire(&br->tail);
>>
>> The offset of the tail field is 0xe so bl->buf_ring should be 0. That's
>> while it has IOBL_BUF_RING flag set. Same goes for the other report. Also,
>> since it's off io_buffer_select(), which looks up the list every time we
>> can exclude the req having a dangling pointer.
> 
> It's funky for sure, the other one is regular classic provided buffers.
> Interestingly, both reports are for arm32...

The other is ring pbuf as well

io_uring_register$IORING_REGISTER_PBUF_RING(r0, 0x16, &(0x7f0000000040)={&(0x7f0000001000)={[{0x0, 0x0, 0x3, 0x700}]}, 0x1, 0x1}, 0x1)

PC is at io_ring_buffers_peek+0x24/0x258 io_uring/kbuf.c:227

Also "tail = smp_load_acquire(&br->tail);"

-- 
Pavel Begunkov