Re: [bug report] BUG: kernel NULL pointer dereference, address: 0000000000000060

[Ming Lei <ming.lei@redhat.com>]

Hi Changhui,

Thanks for the report!

On Tue, Jul 01, 2025 at 09:55:23AM +0800, Changhui Zhong wrote:
> Hello,
> 
> the following kernel panic was triggered by 'ubdsrv  make test T=generic' tests,
> please help check and let me know if you need any info/test, thanks.
> 
> repo: https://github.com/torvalds/linux.git
> branch: master
> INFO: HEAD of cloned kernel:
> commit d0b3b7b22dfa1f4b515fd3a295b3fd958f9e81af
> Author: Linus Torvalds <torvalds@linux-foundation.org>
> Date:   Sun Jun 29 13:09:04 2025 -0700
> 
>     Linux 6.16-rc4
> 
> dmesg log:
> [ 3431.347957] BUG: kernel NULL pointer dereference, address: 0000000000000060
> [ 3431.355744] #PF: supervisor read access in kernel mode
> [ 3431.361484] #PF: error_code(0x0000) - not-present page
> [ 3431.367224] PGD 119ffa067 P4D 0
> [ 3431.370830] Oops: Oops: 0000 [#1] SMP NOPTI
> [ 3431.375503] CPU: 22 UID: 0 PID: 397273 Comm: fio Tainted: G S
>            6.16.0-rc4 #1 PREEMPT(voluntary)
> [ 3431.386864] Tainted: [S]=CPU_OUT_OF_SPEC
> [ 3431.391243] Hardware name: Lenovo ThinkSystem SR650 V2/7Z73CTO1WW,
> BIOS AFE118M-1.32 06/29/2022
> [ 3431.400954] RIP: 0010:ublk_queue_rqs+0x7d/0x1c0 [ublk_drv]

It is one regression of commit 524346e9d79f ("ublk: build batch from IOs in same io_ring_ctx and io task").

io->cmd can't be derefered unless the uring cmd is live, and the following patch
should fix the oops:

diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index c3e3c3b65a6d..99894d712c1f 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -1442,15 +1442,14 @@ static void ublk_queue_rqs(struct rq_list *rqlist)
 		struct ublk_queue *this_q = req->mq_hctx->driver_data;
 		struct ublk_io *this_io = &this_q->ios[req->tag];
 
-		if (io && !ublk_belong_to_same_batch(io, this_io) &&
-				!rq_list_empty(&submit_list))
-			ublk_queue_cmd_list(io, &submit_list);
-		io = this_io;
-
-		if (ublk_prep_req(this_q, req, true) == BLK_STS_OK)
+		if (ublk_prep_req(this_q, req, true) == BLK_STS_OK) {
+			if (io && !ublk_belong_to_same_batch(io, this_io) &&
+					!rq_list_empty(&submit_list))
+				ublk_queue_cmd_list(io, &submit_list);
 			rq_list_add_tail(&submit_list, req);
-		else
+		} else
 			rq_list_add_tail(&requeue_list, req);
+		io = this_io;
 	}
 
 	if (!rq_list_empty(&submit_list))


Thanks,
Ming