Re: [syzbot] [io-uring?] BUG: unable to handle kernel NULL pointer dereference in io_buffer_select

[Jens Axboe <axboe@kernel.dk>]

On 5/12/25 8:19 AM, Pavel Begunkov wrote:
> On 5/12/25 14:56, Jens Axboe wrote:
>> On 5/11/25 6:22 AM, Pavel Begunkov wrote:
>>> On 5/11/25 01:19, syzbot wrote:
> ...>> this line:
>>>
>>> tail = smp_load_acquire(&br->tail);
>>>
>>> The offset of the tail field is 0xe so bl->buf_ring should be 0. That's
>>> while it has IOBL_BUF_RING flag set. Same goes for the other report. Also,
>>> since it's off io_buffer_select(), which looks up the list every time we
>>> can exclude the req having a dangling pointer.
>>
>> It's funky for sure, the other one is regular classic provided buffers.
>> Interestingly, both reports are for arm32...
> 
> The other is ring pbuf as well

True yes, both are pbuf. I can't hit any of this on arm64 or x86-64, fwiw.
Which is why I thought the arm32 connection might be interesting. Not that
the arch should matter at all here, but...

-- 
Jens Axboe