CVE-2025-40235

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots()<br /> <br /> If fs_info-&gt;super_copy or fs_info-&gt;super_for_commit allocated failed in<br /> btrfs_get_tree_subvol(), then no need to call btrfs_free_fs_info().<br /> Otherwise btrfs_check_leaked_roots() would access NULL pointer because<br /> fs_info-&gt;allocated_roots had not been initialised.<br /> <br /> syzkaller reported the following information:<br /> ------------[ cut here ]------------<br /> BUG: unable to handle page fault for address: fffffffffffffbb0<br /> #PF: supervisor read access in kernel mode<br /> #PF: error_code(0x0000) - not-present page<br /> PGD 64c9067 P4D 64c9067 PUD 64cb067 PMD 0<br /> Oops: Oops: 0000 [#1] SMP KASAN PTI<br /> CPU: 0 UID: 0 PID: 1402 Comm: syz.1.35 Not tainted 6.15.8 #4 PREEMPT(lazy)<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), (...)<br /> RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:23 [inline]<br /> RIP: 0010:raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline]<br /> RIP: 0010:atomic_read include/linux/atomic/atomic-instrumented.h:33 [inline]<br /> RIP: 0010:refcount_read include/linux/refcount.h:170 [inline]<br /> RIP: 0010:btrfs_check_leaked_roots+0x18f/0x2c0 fs/btrfs/disk-io.c:1230<br /> [...]<br /> Call Trace:<br /> <br /> btrfs_free_fs_info+0x310/0x410 fs/btrfs/disk-io.c:1280<br /> btrfs_get_tree_subvol+0x592/0x6b0 fs/btrfs/super.c:2029<br /> btrfs_get_tree+0x63/0x80 fs/btrfs/super.c:2097<br /> vfs_get_tree+0x98/0x320 fs/super.c:1759<br /> do_new_mount+0x357/0x660 fs/namespace.c:3899<br /> path_mount+0x716/0x19c0 fs/namespace.c:4226<br /> do_mount fs/namespace.c:4239 [inline]<br /> __do_sys_mount fs/namespace.c:4450 [inline]<br /> __se_sys_mount fs/namespace.c:4427 [inline]<br /> __x64_sys_mount+0x28c/0x310 fs/namespace.c:4427<br /> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]<br /> do_syscall_64+0x92/0x180 arch/x86/entry/syscall_64.c:94<br /> entry_SYSCALL_64_after_hwframe+0x76/0x7e<br /> RIP: 0033:0x7f032eaffa8d<br /> [...]