apport information
** Tags added: apport-collected cloud-image
** Description changed:
SUMMARY
Starting with linux-image-6.8.0-136-generic (noble/24.04), registering an
io_uring
provided buffer ring (IORING_REGISTER_PBUF_RING) with a valid struct
io_uring_buf_reg
fails with EINVAL (errno 22). It succeeds on 6.8.0-134-generic and on mainline
7.0.0-28-generic. 6.8.0-137-generic is also affected, so the defect is
carried in the
noble 6.8 branch, not a one-off build. Provided buffer rings are a standard,
documented
io_uring feature, so this breaks any application that uses them.
REPRODUCED ON OUR HARDWARE (single machine, kernel is the only variable)
Same host, booted each kernel in turn and ran the attached reproducer:
6.8.0-134-generic -> register_buf_ring: OK
6.8.0-136-generic -> register_buf_ring: Invalid argument (EINVAL)
6.8.0-134-generic -> OK again after rebooting back
A production networking service on that host that registers an io_uring
buffer ring on
startup aborts under -136 with SIGABRT (systemd Result: core-dump) at the
failed
registration, and starts normally again on -134. uname -a on the failing boot:
Linux 6.8.0-136-generic #136-Ubuntu SMP PREEMPT_DYNAMIC Wed Jul 1 21:53:05
UTC 2026 x86_64
STEPS TO REPRODUCE
Build and run the attached pbufring.c (pure liburing, ~20 lines):
sudo apt-get install -y liburing-dev gcc
gcc -o pbufring pbufring.c -luring
./pbufring
Expected (good kernel): register_buf_ring: OK
Observed (6.8.0-136 / -137): register_buf_ring: Invalid argument
kernel.io_uring_disabled = 0 and /proc/sys/kernel/io_uring_group = -1 on all
machines,
so this is not an io_uring lockdown / AppArmor difference; the registration
path itself
rejects a valid request.
SUSPECTED CAUSE
Failure is in io_uring provided-buffer-ring registration validation
(io_uring/kbuf.c,
io_register_pbuf_ring(), reserved-field / struct checking). A valid
io_uring_buf_reg
(reserved fields zeroed; ring_addr/ring_entries/bgid set) is rejected;
mainline is fine.
Please check the noble backport of that validation, in particular the
cherry-pick of
upstream commit 1724849072854a66861d461b298b04612702d685 ("io_uring/kbuf: use
mem_is_zero()"), which replaced the manual reg.resv[0]||resv[1]||resv[2]
check with a
mem_is_zero() call. If applied over the wrong offset/size it would zero-check
bytes that
legitimately carry ring_addr/ring_entries/bgid and reject every real
registration. Note
the current noble git tip shows the correct manual resv check, so a fix may
already be
staged; please confirm whether it is queued for 6.8.0-138 and expedite, since
-137
shipped still broken.
WORKAROUNDS (not fixes)
Downgrade to 6.8.0-134-generic and reboot; or, application-side, avoid the
provided-
buffer-ring path where the code supports a fallback.
ENVIRONMENT
Ubuntu 24.04 LTS (noble), x86_64. Regression introduced between 6.8.0-134 and
6.8.0-136;
also present in 6.8.0-137.
+ ---
+ ProblemType: Bug
+ AlsaDevices:
+ total 0
+ crw-rw---- 1 root audio 116, 1 Aug 4 10:34 seq
+ crw-rw---- 1 root audio 116, 33 Aug 4 10:34 timer
+ AlsaVersion: Advanced Linux Sound Architecture Driver Version
k6.8.0-134-generic.
+ AplayDevices: Error: [Errno 2] No such file or directory: 'aplay'
+ ApportVersion: 2.28.1-0ubuntu3.8
+ Architecture: amd64
+ ArecordDevices: Error: [Errno 2] No such file or directory: 'arecord'
+ AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/seq',
'/dev/snd/timer'] failed with exit code 1:
+ CRDA: N/A
+ CasperMD5CheckResult: unknown
+ CloudArchitecture: x86_64
+ CloudBuildName: server
+ CloudID: configdrive
+ CloudName: configdrive
+ CloudPlatform: configdrive
+ CloudSerial: 20250122
+ CloudSubPlatform: config-disk (/dev/nvme0n1p5)
+ DistroRelease: Ubuntu 24.04
+ IwConfig: Error: [Errno 2] No such file or directory: 'iwconfig'
+ MachineType: AsrockRack To be filled by O.E.M.
+ NonfreeKernelModules: zfs
+ Package: linux (not installed)
+ ProcEnviron:
+ LANG=C.UTF-8
+ PATH=(custom, no user)
+ SHELL=/bin/bash
+ TERM=xterm-256color
+ ProcFB: 0 simpledrmdrmfb
+ ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-6.8.0-134-generic
root=UUID=c0b38019-7891-470a-b184-151bcdd42d58 ro nomodeset iommu=pt
console=tty0 console=ttyS1,115200n8 amd_pstate=disable quiet splash
ipv6.disable=1 vt.handoff=7
+ ProcVersionSignature: Ubuntu 6.8.0-134.134-generic 6.8.12
+ RelatedPackageVersions:
+ linux-restricted-modules-6.8.0-134-generic N/A
+ linux-backports-modules-6.8.0-134-generic N/A
+ linux-firmware 20240318.git3b128b60-0ubuntu2.27
+ RfKill: Error: [Errno 2] No such file or directory: 'rfkill'
+ Tags: cloud-image noble
+ Uname: Linux 6.8.0-134-generic x86_64
+ UpgradeStatus: No upgrade log present (probably fresh install)
+ UserGroups: N/A
+ _MarkForUpload: True
+ dmi.bios.date: 10/17/2024
+ dmi.bios.release: 5.35
+ dmi.bios.vendor: American Megatrends International, LLC.
+ dmi.bios.version: 20.01.OV03
+ dmi.board.asset.tag: To be filled by O.E.M.
+ dmi.board.name: B650D4U3-2Q/BCM
+ dmi.board.vendor: ASRockRack
+ dmi.board.version: 3.01A
+ dmi.chassis.asset.tag: To be filled by O.E.M.
+ dmi.chassis.type: 17
+ dmi.chassis.vendor: To be filled by O.E.M.
+ dmi.chassis.version: To be filled by O.E.M.
+ dmi.modalias:
dmi:bvnAmericanMegatrendsInternational,LLC.:bvr20.01.OV03:bd10/17/2024:br5.35:svnAsrockRack:pnTobefilledbyO.E.M.:pvrTobefilledbyO.E.M.:rvnASRockRack:rnB650D4U3-2Q/BCM:rvr3.01A:cvnTobefilledbyO.E.M.:ct17:cvrTobefilledbyO.E.M.:skuTobefilledbyO.E.M.:
+ dmi.product.family: To be filled by O.E.M.
+ dmi.product.name: To be filled by O.E.M.
+ dmi.product.sku: To be filled by O.E.M.
+ dmi.product.version: To be filled by O.E.M.
+ dmi.sys.vendor: AsrockRack
** Attachment added: "CurrentDmesg.txt"
https://bugs.launchpad.net/bugs/2162843/+attachment/5989459/+files/CurrentDmesg.txt
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2162843
Title:
Regression: io_uring provided buffer ring registration
(IORING_REGISTER_PBUF_RING) returns -EINVAL for valid requests on
6.8.0-136 and 6.8.0-137
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2162843/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
