Hi Changhui,

On Mon, Jun 23, 2025 at 10:58:24AM +0800, Changhui Zhong wrote:

Hello,

the following kernel panic was triggered by ubdsrv  generic/002,
please help check and let me know if you need any info/test, thanks.

commit HEAD:

commit 2589cd05008205ee29f5f66f24a684732ee2e3a3
Merge: 98d0347fe8fb e1c75831f682
Author: Jens Axboe [off-list ref]
Date:   Wed Jun 18 05:11:50 2025 -0600

    Merge branch 'io_uring-6.16' into for-next

    * io_uring-6.16:
      io_uring: fix potential page leak in io_sqe_buffer_register()
      io_uring/sqpoll: don't put task_struct on tctx setup failure
      io_uring: remove duplicate io_uring_alloc_task_context() definition

The above branch has been merged to v6.16-rc3, can you reproduce it with -rc3?

I tried to duplicate in my test VM, not succeed with -rc3.

...

[ 7044.064528] BUG: kernel NULL pointer dereference, address: 0000000000000001
[ 7044.071507] #PF: supervisor read access in kernel mode
[ 7044.076653] #PF: error_code(0x0000) - not-present page
[ 7044.081801] PGD 462c42067 P4D 462c42067 PUD 462c43067 PMD 0
[ 7044.087488] Oops: Oops: 0000 [#1] SMP NOPTI
[ 7044.091685] CPU: 13 UID: 0 PID: 367 Comm: kworker/13:1H Not tainted
6.16.0-rc2+ #1 PREEMPT(voluntary)
[ 7044.100991] Hardware name: Dell Inc. PowerEdge R640/0X45NX, BIOS
2.22.2 09/12/2024
[ 7044.108565] Workqueue: kblockd blk_mq_requeue_work
[ 7044.113374] RIP: 0010:__io_req_task_work_add+0x18/0x1f0

Can you share where the above line points to source line if it can be
reproduced in -rc3?

gdb> l *(__io_req_task_work_add+0x18)


Thanks,
Ming