CVE: CVE-2025-38203
Published: 2025-07-04
Description: In the Linux kernel, the following vulnerability has been resolved:

jfs: Fix null-ptr-deref in jfs_ioc_trim

[ Syzkaller Report ]

Oops: general protection fault, probably for non-canonical address
0xdffffc[PII_REDACTED]: 0000 [#1
KASAN: null-ptr-deref in range [0x[PII_REDACTED]000438-0x[PII_REDACTED]00043f]
CPU: 2 UID: 0 PID: 10614 Comm: syz-executor.0 Not tainted
6.13.0-rc6-gfbfd64d25c7a-dirty #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Sched_ext: serialise (enabled+all), task: runnable_at=-30ms
RIP: 0010:jfs_ioc_trim+0x34b/0x8f0
Code: e7 e8 59 a4 87 fe 4d 8b 24 24 4d 8d bc 24 38 04 00 00 48 8d 93
90 82 fe ff 4c 89 ff 31 f6
RSP: 0018:ffffc900055f7cd0 EFLAGS: 00010206
RAX: [PII_REDACTED] RBX: 00005866a9e67ff8 RCX:[PII_REDACTED]00000a
RDX: [PII_REDACTED] RSI: [PII_REDACTED] RDI: [PII_REDACTED]
RBP: dffffc[PII_REDACTED] R08: ffff88807c180003 R09: 1ffff1100f830000
R10: dffffc[PII_REDACTED] R11: ffffed100f830001 R12: [PII_REDACTED]
R13: [PII_REDACTED] R14: [PII_REDACTED] R15: [PII_REDACTED]
FS:  00007fe520225640(0000) GS:ffff8880b7e80000(0000) knlGS:[PII_REDACTED]
CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
CR2: 00005593c91b2c88 CR3:[PII_REDACTED]27c000 CR4:[PII_REDACTED]0006f0
DR0: [PII_REDACTED] DR1: [PII_REDACTED] DR2: [PII_REDACTED]
DR3: [PII_REDACTED] DR6: 00000000fffe0ff0 DR7: [PII_REDACTED]
Call Trace:
<TASK>
? __die_body+0x61/0xb0
? die_addr+0xb1/0xe0
? exc_general_protection+0x333/0x510
? asm_exc_general_protection+0x26/0x30
? jfs_ioc_trim+0x34b/0x8f0
jfs_ioctl+0x3c8/0x4f0
? __pfx_jfs_ioctl+0x10/0x10
? __pfx_jfs_ioctl+0x10/0x10
__se_sys_ioctl+0x269/0x350
? __pfx___se_sys_ioctl+0x10/0x10
? do_syscall_64+0xfb/0x210
do_syscall_64+0xee/0x210
? syscall_exit_to_user_mode+0x1e0/0x330
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe51f4903ad
Code: c3 e8 a7 2b 00 00 0f 1f 80 00 00 00 00 f3 0f 1e fa 48 89 f8 48
89 f7 48 89 d6 48 89 ca 4d
RSP: 002b:00007fe5202250c8 EFLAGS: 00000246 ORIG_RAX: [PII_REDACTED]
RAX: ffffffffffffffda RBX: 00007fe51f5cbf80 RCX: 00007fe51f4903ad
RDX: [PII_REDACTED] RSI: 00000000c0185879 RDI: [PII_REDACTED]
RBP: [PII_REDACTED] R08: [PII_REDACTED] R09: [PII_REDACTED]
R10: [PII_REDACTED] R11: [PII_REDACTED] R12: 00007fe520225640
R13:[PII_REDACTED]00000e R14: 00007fe51f44fca0 R15: 00007fe52021d000
</TASK>
Modules linked in:
---[ end trace [PII_REDACTED] ]---
RIP: 0010:jfs_ioc_trim+0x34b/0x8f0
Code: e7 e8 59 a4 87 fe 4d 8b 24 24 4d 8d bc 24 38 04 00 00 48 8d 93
90 82 fe ff 4c 89 ff 31 f6
RSP: 0018:ffffc900055f7cd0 EFLAGS: 00010206
RAX: [PII_REDACTED] RBX: 00005866a9e67ff8 RCX:[PII_REDACTED]00000a
RDX: [PII_REDACTED] RSI: [PII_REDACTED] RDI: [PII_REDACTED]
RBP: dffffc[PII_REDACTED] R08: ffff88807c180003 R09: 1ffff1100f830000
R10: dffffc[PII_REDACTED] R11: ffffed100f830001 R12: [PII_REDACTED]
R13: [PII_REDACTED] R14: [PII_REDACTED] R15: [PII_REDACTED]
FS:  00007fe520225640(0000) GS:ffff8880b7e80000(0000) knlGS:[PII_REDACTED]
CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
CR2: 00005593c91b2c88 CR3:[PII_REDACTED]27c000 CR4:[PII_REDACTED]0006f0
DR0: [PII_REDACTED] DR1: [PII_REDACTED] DR2: [PII_REDACTED]
DR3: [PII_REDACTED] DR6: 00000000fffe0ff0 DR7: [PII_REDACTED]
Kernel panic - not syncing: Fatal exception

[ Analysis ]

We believe that we have found a concurrency bug in the `fs/jfs` module
that results in a null pointer dereference. There is a closely related
issue which has been fixed:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d6c1b3599b2feb5c7291f5ac3a36e5fa7cedb234

... but, unfortunately, the accepted patch appears to still be
susceptible to a null pointer dereference under some interleavings.

To trigger the bug, we think that `JFS_SBI(ipbmap->i_sb)->bmap` is set
to NULL in `dbFreeBits` and then dereferenced in `jfs_ioc_trim`. This
bug manifests quite rarely under normal circumstances, but is
triggereable from a syz-program.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0d50231d473f89024158dc62624930de45d13718; https://git.kernel.org/stable/c/4a8cb9908b51500a76f5156423bd295df53bff89; https://git.kernel.org/stable/c/9806ae34d7d661c372247cd36f83bfa0523d60ed