Re: [PATCH v2] io_uring: initialize task context before running the BPF loop

[Jens Axboe]

On Wed, 23 Sep 2026 09:43:10 +0800, Yao Kai wrote:
> Submitting SQEs through an io_uring BPF loop can trigger a NULL pointer
> dereference in io_submit_sqes(), as shown by the following arm64 report:
> 
>   [ 2049.380301] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
>   [ 2049.388788] pc : io_submit_sqes+0x48/0x6c4
>   [ 2049.389153] lr : bpf_io_uring_submit_sqes+0x10/0x1c
>   [ 2049.396310] Call trace:
>   [ 2049.396531]  io_submit_sqes+0x48/0x6c4 (P)
>   [ 2049.396893]  bpf_io_uring_submit_sqes+0x10/0x1c
>   [ 2049.397293]  bpf_prog_1a2a95cb199202b5+0x3c/0x68
>   [ 2049.397699]  bpf__io_uring_bpf_ops_loop_step+0x5c/0x94
>   [ 2049.398149]  io_run_loop+0x70/0x2e4
>   [ 2049.398461]  __arm64_sys_io_uring_enter+0xf0/0x710
>   [ 2049.398882]  invoke_syscall+0x54/0x10c
>   [ 2049.399414]  el0_svc_common.constprop.0+0x40/0xe0
>   [ 2049.399829]  do_el0_svc+0x1c/0x28
>   [ 2049.400125]  el0_svc+0x38/0x1d0
>   [ 2049.400409]  el0t_64_sync_handler+0xa0/0xe4
>   [ 2049.400779]  el0t_64_sync+0x198/0x19c
> 
> [...]

Applied, thanks!

[1/1] io_uring: initialize task context before running the BPF loop
      commit: a3bdf68feecc57af5c11fb599f860ac9790ffad9

Best regards,
-- 
Jens Axboe