Thank you for highlighting that, part of the design criteria for io_uring was indeed to be able to do everything. It's even mentioned in the second sentence of the linked write-up, no more "everything is a file... until you need to do IO to it".
This is correct, the "u" is for userspace/usermapped. The memory is actually allocate by the kernel, but it's mapped into the applications address space.
The buffers are supplied elsewhere outside that example, just consider it an array of pointers to buffers of size BUF_SIZE. br->bufs[] is the shared space, it holds information on the address/size/id of a given buffer.