CVE-2025-39731

In the Linux kernel, the following vulnerability has been resolved:

f2fs: vmunmapram() may be called from an invalid context

When testing F2FS with xfstests using UFS backed virtual disks the kernel complains sometimes that f2fsreleasedecompmem() calls vmunmap_ram() from an invalid context. Example trace from f2fs/007 test:

f2fs/007 5s ... [12:59:38][ 8.902525] run fstests f2fs/007 [ 11.468026] BUG: sleeping function called from invalid context at mm/vmalloc.c:2978 [ 11.471849] inatomic(): 1, irqsdisabled(): 1, nonblock: 0, pid: 68, name: irq/22-ufshcd [ 11.475357] preemptcount: 1, expected: 0 [ 11.476970] RCU nest depth: 0, expected: 0 [ 11.478531] CPU: 0 UID: 0 PID: 68 Comm: irq/22-ufshcd Tainted: G W 6.16.0-rc5-xfstests-ufs-g40f92e79b0aa #9 PREEMPT(none) [ 11.478535] Tainted: [W]=WARN [ 11.478536] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.478537] Call Trace: [ 11.478543] <TASK> [ 11.478545] dumpstacklvl+0x4e/0x70 [ 11.478554] __mightresched.cold+0xaf/0xbe [ 11.478557] vmunmap_ram+0x21/0xb0 [ 11.478560] f2fsreleasedecompmem+0x59/0x80 [ 11.478563] f2fsfreedic+0x18/0x1a0 [ 11.478565] f2fsfinishreadbio+0xd7/0x290 [ 11.478570] blkupdaterequest+0xec/0x3b0 [ 11.478574] ? sbitmapqueueclear+0x3b/0x60 [ 11.478576] scsiendrequest+0x27/0x1a0 [ 11.478582] scsiiocompletion+0x40/0x300 [ 11.478583] ufshcdmcqpollcqelock+0xa3/0xe0 [ 11.478588] ufshcdslintr+0x194/0x1f0 [ 11.478592] ufshcdthreadedintr+0x68/0xb0 [ 11.478594] ? __pfxirqthread_fn+0x10/0x10 [ 11.478599] irqthreadfn+0x20/0x60 [ 11.478602] ? __pfxirqthreadfn+0x10/0x10 [ 11.478603] irqthread+0xb9/0x180 [ 11.478605] ? __pfxirqthread_dtor+0x10/0x10 [ 11.478607] ? __pfxirqthread+0x10/0x10 [ 11.478609] kthread+0x10a/0x230 [ 11.478614] ? __pfxkthread+0x10/0x10 [ 11.478615] retfrom_fork+0x7e/0xd0 [ 11.478619] ? __pfxkthread+0x10/0x10 [ 11.478621] retfromforkasm+0x1a/0x30 [ 11.478623] </TASK>

This patch modifies intask() check inside f2fsreadendio() to also check if interrupts are disabled. This ensures that pages are unmapped asynchronously in an interrupt handler.