Public bug reported:
SUMMARY
Starting with linux-image-6.8.0-136-generic (noble/24.04), registering an
io_uring
provided buffer ring (IORING_REGISTER_PBUF_RING) with a valid struct
io_uring_buf_reg
fails with EINVAL (errno 22). It succeeds on 6.8.0-134-generic and on mainline
7.0.0-28-generic. 6.8.0-137-generic is also affected, so the defect is carried
in the
noble 6.8 branch, not a one-off build. Provided buffer rings are a standard,
documented
io_uring feature, so this breaks any application that uses them.
REPRODUCED ON OUR HARDWARE (single machine, kernel is the only variable)
Same host, booted each kernel in turn and ran the attached reproducer:
6.8.0-134-generic -> register_buf_ring: OK
6.8.0-136-generic -> register_buf_ring: Invalid argument (EINVAL)
6.8.0-134-generic -> OK again after rebooting back
A production networking service on that host that registers an io_uring buffer
ring on
startup aborts under -136 with SIGABRT (systemd Result: core-dump) at the failed
registration, and starts normally again on -134. uname -a on the failing boot:
Linux 6.8.0-136-generic #136-Ubuntu SMP PREEMPT_DYNAMIC Wed Jul 1 21:53:05
UTC 2026 x86_64
STEPS TO REPRODUCE
Build and run the attached pbufring.c (pure liburing, ~20 lines):
sudo apt-get install -y liburing-dev gcc
gcc -o pbufring pbufring.c -luring
./pbufring
Expected (good kernel): register_buf_ring: OK
Observed (6.8.0-136 / -137): register_buf_ring: Invalid argument
kernel.io_uring_disabled = 0 and /proc/sys/kernel/io_uring_group = -1 on all
machines,
so this is not an io_uring lockdown / AppArmor difference; the registration
path itself
rejects a valid request.
SUSPECTED CAUSE
Failure is in io_uring provided-buffer-ring registration validation
(io_uring/kbuf.c,
io_register_pbuf_ring(), reserved-field / struct checking). A valid
io_uring_buf_reg
(reserved fields zeroed; ring_addr/ring_entries/bgid set) is rejected; mainline
is fine.
Please check the noble backport of that validation, in particular the
cherry-pick of
upstream commit 1724849072854a66861d461b298b04612702d685 ("io_uring/kbuf: use
mem_is_zero()"), which replaced the manual reg.resv[0]||resv[1]||resv[2] check
with a
mem_is_zero() call. If applied over the wrong offset/size it would zero-check
bytes that
legitimately carry ring_addr/ring_entries/bgid and reject every real
registration. Note
the current noble git tip shows the correct manual resv check, so a fix may
already be
staged; please confirm whether it is queued for 6.8.0-138 and expedite, since
-137
shipped still broken.
WORKAROUNDS (not fixes)
Downgrade to 6.8.0-134-generic and reboot; or, application-side, avoid the
provided-
buffer-ring path where the code supports a fallback.
ENVIRONMENT
Ubuntu 24.04 LTS (noble), x86_64. Regression introduced between 6.8.0-134 and
6.8.0-136;
also present in 6.8.0-137.
** Affects: linux (Ubuntu)
Importance: Undecided
Status: New
** Attachment added: "pbufring.c"
https://bugs.launchpad.net/bugs/2162843/+attachment/5989436/+files/pbufring.c
** Summary changed:
- Regression: io_uring provided buffer ring registration
(IORING_REGISTER_PBUF_RING) returns -EINVAL for valid requests on 6.8.0-136 and
6.8.0-137 It'll then search for similar bugs — none match
+ Regression: io_uring provided buffer ring registration
(IORING_REGISTER_PBUF_RING) returns -EINVAL for valid requests on 6.8.0-136 and
6.8.0-137
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2162843
Title:
Regression: io_uring provided buffer ring registration
(IORING_REGISTER_PBUF_RING) returns -EINVAL for valid requests on
6.8.0-136 and 6.8.0-137
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2162843/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
