CVE-2025-40147

In the Linux kernel, the following vulnerability has been resolved:

blk-throttle: fix access race during throttle policy activation

On repeated cold boots we occasionally hit a NULL pointer crash in blkshouldthrotl() when throttling is consulted before the throttle policy is fully enabled for the queue. Checking only q->td != NULL is insufficient during early initialization, so blkgtopd() for the throttle policy can still return NULL and blkgtotg() becomes NULL, which later gets dereferenced.

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000156 ... pc : submitbionoacct+0x14c/0x4c8 lr : submitbionoacct+0x48/0x4c8 sp : ffff800087f0b690 x29: ffff800087f0b690 x28: 0000000000005f90 x27: ffff00068af393c0 x26: 0000000000080000 x25: 000000000002fbc0 x24: ffff000684ddcc70 x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000 x20: 0000000000080000 x19: ffff000684ddcd08 x18: ffffffffffffffff x17: 0000000000000000 x16: ffff80008132a550 x15: 0000ffff98020fff x14: 0000000000000000 x13: 1fffe000d11d7021 x12: ffff000688eb810c x11: ffff00077ec4bb80 x10: ffff000688dcb720 x9 : ffff80008068ef60 x8 : 00000a6fb8a86e85 x7 : 000000000000111e x6 : 0000000000000002 x5 : 0000000000000246 x4 : 0000000000015cff x3 : 0000000000394500 x2 : ffff000682e35e40 x1 : 0000000000364940 x0 : 000000000000001a Call trace: submitbionoacct+0x14c/0x4c8 veritymap+0x178/0x2c8 _mapbio+0x228/0x250 dmsubmitbio+0x1c4/0x678 _submitbio+0x170/0x230 submitbionoacctnocheck+0x16c/0x388 submitbionoacct+0x16c/0x4c8 submitbio+0xb4/0x210 f2fssubmitreadbio+0x4c/0xf0 f2fsmpagereadpages+0x3b0/0x5f0 f2fs_readahead+0x90/0xe8

Tighten blkthrotlactivated() to also require that the throttle policy bit is set on the queue:

return q->td != NULL && testbit(blkcgpolicythrotl.plid, q->blkcgpols);

This prevents blkshouldthrotl() from accessing throttle group state until policy data has been attached to blkgs.