CVE-2025-39878

In the Linux kernel, the following vulnerability has been resolved:

ceph: fix crash after fscryptencryptpagecache_blocks() error

The function movedirtyfolioinpagearray() was created by commit ce80b76dd327 ("ceph: introduce cephprocessfoliobatch() method") by moving code from cephwritepagesstart() to this function.

This new function is supposed to return an error code which is checked by the caller (now cephprocessfoliobatch()), and on error, the caller invokes redirtypageforwritepage() and then breaks from the loop.

However, the refactoring commit has gone wrong, and it by accident, it always returns 0 (= success) because it first NULLs the pointer and then returns PTR_ERR(NULL) which is always 0. This means errors are silently ignored, leaving NULL entries in the page array, which may later crash the kernel.

The simple solution is to call PTR_ERR() before clearing the pointer.