[SRU][N:linux-bluefield][PATCH v1 0/1] UBUNTU: SAUCE: io_uring/kbuf: fix inverted reserved-field checks

[Uri Dar]

BugLink: https://bugs.launchpad.net/bugs/2162843

SRU Justification:

[IMPACT]
Since linux-bluefield 6.8.0-1028 (noble 6.8.0-136), registering an io_uring
provided buffer ring with IORING_REGISTER_PBUF_RING fails with -EINVAL for
every valid request; IORING_UNREGISTER_PBUF_RING and
IORING_REGISTER_PBUF_STATUS fail the same way. Requests with non-zero
reserved fields, which must be rejected, are accepted instead.

liburing's io_uring_register_buf_ring() and io_uring_setup_buf_ring() are
therefore unusable. On BlueField, SPDK's uring sock module fails to
initialise and logs on every application start:

  uring.c:1481:uring_sock_group_impl_create: *ERROR*: Failed to create
  buffer ring (errno=22: Invalid argument)

The cause is the noble backport of upstream commit 1724849072854a
("io_uring/kbuf: use mem_is_zero()"), taken from 6.12.y stable in the
2026-06-16 stable patchset (LP: #2156956). mem_is_zero() did not exist in
noble at that point, so !mem_is_zero(x) was rewritten as !memchr_inv(x).
Since mem_is_zero() is defined as !memchr_inv(), the correct equivalent is
memchr_inv(x) without the negation, so all three checks are inverted.

The same backport is in noble/linux 6.8.0-136 .. 6.8.0-147 and in other
noble derivatives (e.g. linux-nvidia 6.8.0-1059 .. 6.8.0-1064).
io_uring/kbuf.c is identical in all of them, so this patch applies there
unchanged.

[FIX]
One custom patch is submitted:
- UBUNTU: SAUCE: io_uring/kbuf: fix inverted reserved-field checks -
  drops the negation in io_register_pbuf_ring(), io_unregister_pbuf_ring()
  and io_register_pbuf_status(), so the reserved-field checks match
  upstream again.

[TEST CASE]
Compile tested on linux-bluefield-6.8 on the master-next branch.

Functional test on BlueField-3 (BFB 3.5.0-75, Ubuntu 24.04, 64k pages)
with a raw-syscall reproducer: io_uring_setup(), then
IORING_REGISTER_PBUF_RING, IORING_REGISTER_PBUF_STATUS and
IORING_UNREGISTER_PBUF_RING with zeroed reserved fields (must succeed),
then IORING_REGISTER_PBUF_RING with resv[0] = 0xdeadbeef (must fail with
-EINVAL).

6.8.0-1028-bluefield-64k (stock):
  register   resv=0          -> -EINVAL   (expected 0)
  status     resv=0          -> -EINVAL   (expected 0)
  unregister resv=0          -> -EINVAL   (expected 0)
  register   resv=0xdeadbeef -> 0         (expected -EINVAL)

6.8.0-1028.33 + this patch:
  register   resv=0          -> 0         (expected 0)
  status     resv=0          -> 0         (expected 0)
  unregister resv=0          -> 0         (expected 0)
  register   resv=0xdeadbeef -> -EINVAL   (expected -EINVAL)

[Regression Potential]
Low. The change only restores the upstream semantics of the reserved-field
validation in three io_uring buffer-ring registration calls. Callers that
pass non-zero reserved fields, which were wrongly accepted since
6.8.0-1028, get -EINVAL again, as on every other kernel.

Uri Dar (1):
  UBUNTU: SAUCE: io_uring/kbuf: fix inverted reserved-field checks

 io_uring/kbuf.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

-- 
2.43.0