Re: [PATCH] io_uring: fix null-ptr-deref in io_uring_poll

[Jens Axboe]

On 4/9/26 8:55 AM, l1zao@xxxxxxxxxx wrote:
> From: Haocheng Yu <l1zao@xxxxxxxxxx>
> 
> A general protection fault in io_uring_poll is reported by a
> modified Syzkaller-based kernel fuzzing tool we developed. The
> crash occurs due to KASAN: null-ptr-deref.
> 
> This issue is likely caused by a race condition between 
> `io_uring_register` and `poll`. Specifically, in 
> io_uring/register.c/io_register_resize_rings(), ctx->rings is 
> set to NULL. Although this step is protected by a mutex lock 
> and a spin lock, io_uring/io_uring.c/io_uring_poll() calls 
> io_sqring_full and __io_cqring_events_user without holding the 
> lock, in which ctx->rings is accessed.
> 
> To fix this vulnerability, I moved the two function calls in
> io_uring_poll() that might access ctx->rings under the protection
> of spin_lock(&ctx->completion_lock).

Fixed a month ago, what tree are you running?

 commit 96189080265e6bb5dde3a4afbaf947af493e3f82
Author: Jens Axboe <axboe@xxxxxxxxx>
Date:   Mon Mar 9 14:21:37 2026 -0600

    io_uring: ensure ctx->rings is stable for task work flags manipulation

-- 
Jens Axboe