CVE-2025-40100 — btrfs: do not assert we found block group item when creating free space tree

Affected: Linux

In the Linux kernel, the following vulnerability has been resolved:

btrfs: do not assert we found block group item when creating free space tree

Currently, when building a free space tree at populate_free_space_tree(), if we are not using the block group tree feature, we always expect to find block group items (either extent items or a block group item with key type BTRFS_BLOCK_GROUP_ITEM_KEY) when we search the extent tree with btrfs_search_slot_for_read(), so we assert that we found an item. However this expectation is wrong since we can have a new block group created in the current transaction which is still empty and for which we still have not added the block group's item to the extent tree, in which case we do not have any items in the extent tree associated to the block group.

The insertion of a new block group's block group item in the extent tree happens at btrfs_create_pending_block_groups() when it calls the helper insert_block_group_item(). This typically is done when a transaction handle is released, committed or when running delayed refs (either as part of a transaction commit or when serving tickets for space reservation if we are low on free space).

So remove the assertion at populate_free_space_tree() even when the block group tree feature is not enabled and update the comment to mention this case.

Syzbot reported this with the following stack trace:

BTRFS info (device loop3 state M): rebuilding free space tree assertion failed: ret == 0 :: 0, in f…

Most recent entries from all

CVE-2025-40100 — btrfs: do not assert we found block group item when creating free space tree