CVE-2025-40235

In the Linux kernel, the following vulnerability has been resolved:

btrfs: directly free partially initialized fsinfo in btrfscheckleakedroots()

If fsinfo->supercopy or fsinfo->superforcommit allocated failed in btrfsgettreesubvol(), then no need to call btrfsfreefsinfo(). Otherwise btrfscheckleakedroots() would access NULL pointer because fsinfo->allocatedroots had not been initialised.

syzkaller reported the following information: ------------[ cut here ]------------ BUG: unable to handle page fault for address: fffffffffffffbb0 #PF: supervisor read access in kernel mode #PF: errorcode(0x0000) - not-present page PGD 64c9067 P4D 64c9067 PUD 64cb067 PMD 0 Oops: Oops: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 1402 Comm: syz.1.35 Not tainted 6.15.8 #4 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), (...) RIP: 0010:archatomicread arch/x86/include/asm/atomic.h:23 [inline] RIP: 0010:rawatomicread include/linux/atomic/atomic-arch-fallback.h:457 [inline] RIP: 0010:atomicread include/linux/atomic/atomic-instrumented.h:33 [inline] RIP: 0010:refcountread include/linux/refcount.h:170 [inline] RIP: 0010:btrfscheckleakedroots+0x18f/0x2c0 fs/btrfs/disk-io.c:1230 [...] Call Trace: <TASK> btrfsfreefsinfo+0x310/0x410 fs/btrfs/disk-io.c:1280 btrfsgettreesubvol+0x592/0x6b0 fs/btrfs/super.c:2029 btrfsgettree+0x63/0x80 fs/btrfs/super.c:2097 vfsgettree+0x98/0x320 fs/super.c:1759 donewmount+0x357/0x660 fs/namespace.c:3899 pathmount+0x716/0x19c0 fs/namespace.c:4226 domount fs/namespace.c:4239 [inline] __dosysmount fs/namespace.c:4450 [inline] __sesysmount fs/namespace.c:4427 [inline] __x64sysmount+0x28c/0x310 fs/namespace.c:4427 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0x92/0x180 arch/x86/entry/syscall64.c:94 entrySYSCALL64afterhwframe+0x76/0x7e RIP: 0033:0x7f032eaffa8d [...]