I ran into this while working on a C++23 entry for the Twelve Dollar Server Challenge. Some entries already work around this bug by retrying registration with nonzero reserved fields.
I checked all three reserved-field checks in io_uring/kbuf.c: - io_register_pbuf_ring() - io_unregister_pbuf_ring() - io_register_pbuf_status() They use !memchr_inv(..., 0, ...) where they need memchr_inv(..., 0, ...). Valid zero-filled fields are rejected; nonzero ones are accepted. Upstream commit 172484907285 is correct. The inversion is in Ubuntu's adaptation. Ubuntu 6.8.0-136, -139, -147 and -149 sources have identical affected kbuf.c files; -134 has the correct checks. Noble master-next at 6dcf89bf9d1650d117680189bf4bbb596af7ab84 still has the bug. I tested a standalone raw-syscall reproducer with 6.8 UAPI headers: - 6.8.0-117-generic: 17/17 pass. - Official 6.8.0-139-generic in QEMU: 17/17 fail with inverted results. - Custom build from Ubuntu 6.8.0-139.139, unpatched: 17/17 fail. - Same source, config and initramfs, with the three negations removed: 17/17 pass. The custom builds use a minimal x86-64 QEMU config. I haven't tested a full Ubuntu generic build or application benchmarks. The Bluefield master-next log lists Uri Dar's existing fix: 1473fb4e7a3198b834878dce273d2311738a353a UBUNTU: SAUCE: io_uring/kbuf: fix inverted reserved-field checks https://git.launchpad.net/~canonical-kernel-bluefield/ubuntu/+source/linux-bluefield/+git/noble/log/?h=master-next I also compared kbuf.c in Ubuntu-bluefield-6.8.0-1035.40. It exactly matches the affected Noble file with these three negations removed. Could this existing fix be carried to Noble linux/generic? The Jammy HWE report in comment #19 may need the same follow-up; I haven't checked Jammy's source. Attached: pbuf_reserved.c, both custom-build test logs and the kernel config. The reproducer needs no liburing. With 6.8+ UAPI headers: cc -std=c11 -O2 -Wall -Wextra -Werror -Wpedantic pbuf_reserved.c -o pbuf_reserved ./pbuf_reserved With 6.8 headers this runs 17 checks. Newer headers may change the check count. ** Attachment added: "Raw-syscall reproducer, before/after test logs and minimal QEMU kernel config" https://bugs.launchpad.net/ubuntu/+source/linux-bluefield/+bug/2162843/+attachment/6015189/+files/launchpad-pbuf-tests.tar.gz -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2162843 Title: Regression: io_uring provided buffer ring registration (IORING_REGISTER_PBUF_RING) returns -EINVAL for valid requests on 6.8.0-136 and 6.8.0-137 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2162843/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
