CVE-2025-38255

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> lib/group_cpus: fix NULL pointer dereference from group_cpus_evenly()<br /> <br /> While testing null_blk with configfs, echo 0 &gt; poll_queues will trigger<br /> following panic:<br /> <br /> BUG: kernel NULL pointer dereference, address: 0000000000000010<br /> Oops: Oops: 0000 [#1] SMP NOPTI<br /> CPU: 27 UID: 0 PID: 920 Comm: bash Not tainted 6.15.0-02023-gadbdb95c8696-dirty #1238 PREEMPT(undef)<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014<br /> RIP: 0010:__bitmap_or+0x48/0x70<br /> Call Trace:<br /> <br /> __group_cpus_evenly+0x822/0x8c0<br /> group_cpus_evenly+0x2d9/0x490<br /> blk_mq_map_queues+0x1e/0x110<br /> null_map_queues+0xc9/0x170 [null_blk]<br /> blk_mq_update_queue_map+0xdb/0x160<br /> blk_mq_update_nr_hw_queues+0x22b/0x560<br /> nullb_update_nr_hw_queues+0x71/0xf0 [null_blk]<br /> nullb_device_poll_queues_store+0xa4/0x130 [null_blk]<br /> configfs_write_iter+0x109/0x1d0<br /> vfs_write+0x26e/0x6f0<br /> ksys_write+0x79/0x180<br /> __x64_sys_write+0x1d/0x30<br /> x64_sys_call+0x45c4/0x45f0<br /> do_syscall_64+0xa5/0x240<br /> entry_SYSCALL_64_after_hwframe+0x76/0x7e<br /> <br /> Root cause is that numgrps is set to 0, and ZERO_SIZE_PTR is returned from<br /> kcalloc(), and later ZERO_SIZE_PTR will be deferenced.<br /> <br /> Fix the problem by checking numgrps first in group_cpus_evenly(), and<br /> return NULL directly if numgrps is zero.<br /> <br /> [yukuai3@huawei.com: also fix the non-SMP version]