Merge tag 'mm-core-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/mm/coreHEADmaster

Pull core memory management fixes from David Hildenbrand:
 "Here's a bigger set of MM fixes that we didn't manage to have ready
  for -rc1. All fixes are stable-worthy; the majority fixes nasty
  long-standing bugs instead of being purely hotfixes.

  We have some more of these kinds of stable-worthy fixes in the
  pipeline, but we'll focus on the really urgent fixes as we get closer
  to the release.

  (Leaving urgent MM fixes lurking for various weeks is not good, but
  having too many changes close to the release is also not good, it's
  tricky ...)

  Most issues were reported by Anthropic. Others were found while
  reworking proposed fixes, and of course some of the fixes were just
  reported and fixed on the mailing list.

  All fixes were in linux-next for several days without changes. Some
  commit IDs changed recently when I had to drop some non-stable fixes,
  rebased to -rc1 and picked up more trailers.

  This includes fixes to:
   - THP (Transparent Huge Pages)
   - GUP (Get User Pages)
   - KSM (Kernel Samepage Merging)
   - USERFAULTFD
   - SHARED MEMORY (shmem/tmpfs/memfd)
   - HUGETLB
   - Core MM, PAGE CACHE and MEMORY RECLAIM

  The main changes are:

   - Prevent information leaks through memfd pinning, and out-of bounds
     writes in GUP.

   - Fix data loss in shmem, THP collapse, KSM and memfd pinning.

   - Fix corruption and reference-counting errors with huge PMD/PUD
     mappings, and incorrect TLB flushing and unmapping.

   - Fix various use-after-free bugs, deadlocks and unkillable loops,
     witha a focus on shmem swap handling.

   - Fix execution-seal enforcement for memfd (incl. hugetlb).

  Other changes fix accounting, quota and userfaultfd (un)registration
  handling"

* tag 'mm-core-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/mm/core: (61 commits)
  mm/gup: check folio->mapping under folio lock in memfd_pin_folios()
  khugepaged: fix readahead lock inversion in collapse_file()
  mm/huge_memory: set the mmu_gather page size in zap_huge_pud()
  mm/memory-tiers: unregister empty tiers outside memory_tier_lock
  mm/cma: don't release CMA pages still in use
  mm/vma: don't leak the charge for stack growth
  mm/huge_memory: split huge PUDs when adjusting VMA boundaries
  mm/vma: call ->may_split() before a partial merge
  mm/ksm: check large swap-cache folios before mapping them
  mm/ksm: fix use of a freed anon_vma at swap-in
  mm/ksm: reset the unstable trees of all nodes
  mm: fix deadlock of mremap() against UFFDIO_MOVE
  mm: fix unkillable fault loop on MAP_DROPPABLE memory
  mm: fix unmap_mapping_range() beyond 4 GiB on 32-bit
  mm/memory: reject remote COW faults on PFN mappings
  mm/madvise: fix data loss from MADV_FREE on a KSM page
  mm/mremap: fix moving PUD leaves
  mm/mremap: recheck PUDs under the page table lock
  mm/mremap: use pudp_huge_get_and_clear() when moving huge PUDs
  mm/mmu_notifier: set ->mm only after mmgrab()
  ...

6 files changed, 22 insertions, 18 deletions

diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h
index c745f7ad2298..fac05120ab77 100644
--- a/include/linux/huge_mm.h
+++ b/include/linux/huge_mm.h
@@ -12,9 +12,8 @@ int copy_huge_pmd(struct mm_struct *dst_mm, struct mm_struct *src_mm,
 		  pmd_t *dst_pmd, pmd_t *src_pmd, unsigned long addr,
 		  struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma);
 bool huge_pmd_set_accessed(struct vm_fault *vmf);
-int copy_huge_pud(struct mm_struct *dst_mm, struct mm_struct *src_mm,
-		  pud_t *dst_pud, pud_t *src_pud, unsigned long addr,
-		  struct vm_area_struct *vma);
+int copy_huge_pud(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma,
+		pud_t *dst_pud, pud_t *src_pud, unsigned long addr);
 
 #ifdef CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD
 void huge_pud_set_accessed(struct vm_fault *vmf, pud_t orig_pud);
diff --git a/include/linux/ksm.h b/include/linux/ksm.h
index d39d0d5483a2..a0d358a1feb6 100644
--- a/include/linux/ksm.h
+++ b/include/linux/ksm.h
@@ -91,8 +91,8 @@ static inline void ksm_exit(struct mm_struct *mm)
  * We'd like to make this conditional on vma->vm_flags & VM_MERGEABLE,
  * but what if the vma was unmerged while the page was swapped out?
  */
-struct folio *ksm_might_need_to_copy(struct folio *folio,
-			struct vm_area_struct *vma, unsigned long addr);
+struct folio *ksm_might_need_to_copy(struct folio *folio, struct page *page,
+		struct vm_area_struct *vma, unsigned long addr);
 
 void rmap_walk_ksm(struct folio *folio, struct rmap_walk_control *rwc);
 void folio_migrate_ksm(struct folio *newfolio, struct folio *folio);
@@ -145,7 +145,7 @@ static inline int ksm_madvise(struct vm_area_struct *vma, unsigned long start,
 }
 
 static inline struct folio *ksm_might_need_to_copy(struct folio *folio,
-			struct vm_area_struct *vma, unsigned long addr)
+		struct page *page, struct vm_area_struct *vma, unsigned long addr)
 {
 	return folio;
 }
diff --git a/include/linux/memfd.h b/include/linux/memfd.h
index c159e40e3f34..272479317cf1 100644
--- a/include/linux/memfd.h
+++ b/include/linux/memfd.h
@@ -2,10 +2,19 @@
 #ifndef __LINUX_MEMFD_H
 #define __LINUX_MEMFD_H
 
+#include <linux/fcntl.h>
 #include <linux/file.h>
 
 #define MEMFD_ANON_NAME "[memfd]"
 
+static inline int memfd_check_seals_mode(unsigned int seals, umode_t old_mode,
+		umode_t new_mode)
+{
+	if ((seals & F_SEAL_EXEC) && ((old_mode ^ new_mode) & 0111))
+		return -EPERM;
+	return 0;
+}
+
 #ifdef CONFIG_MEMFD_CREATE
 extern long memfd_fcntl(struct file *file, unsigned int cmd, unsigned int arg);
 struct folio *memfd_alloc_folio(struct file *memfd, pgoff_t idx);
diff --git a/include/linux/mmu_notifier.h b/include/linux/mmu_notifier.h
index a11a44eef521..5db78e5761c5 100644
--- a/include/linux/mmu_notifier.h
+++ b/include/linux/mmu_notifier.h
@@ -483,7 +483,8 @@ mmu_notifier_invalidate_range_start(struct mmu_notifier_range *range)
 /*
  * This version of mmu_notifier_invalidate_range_start() avoids blocking, but it
  * can return an error if a notifier can't proceed without blocking, in which
- * case you're not allowed to modify PTEs in the specified range.
+ * case you're not allowed to modify PTEs in the specified range or call
+ * mmu_notifier_invalidate_range_end().
  *
  * This is mainly intended for OOM handling.
  */
diff --git a/include/linux/shmem_fs.h b/include/linux/shmem_fs.h
index a7c7a96a7cbf..f89b4b151133 100644
--- a/include/linux/shmem_fs.h
+++ b/include/linux/shmem_fs.h
@@ -117,8 +117,14 @@ extern unsigned long shmem_get_unmapped_area(struct file *, unsigned long addr,
 		unsigned long len, unsigned long pgoff, unsigned long flags);
 extern int shmem_lock(struct file *file, int lock, struct ucounts *ucounts);
 #ifdef CONFIG_SHMEM
+bool shmem_file(struct file *file);
 bool shmem_mapping(const struct address_space *mapping);
 #else
+static inline bool shmem_file(struct file *file)
+{
+	return false;
+}
+
 static inline bool shmem_mapping(const struct address_space *mapping)
 {
 	return false;
@@ -193,15 +199,6 @@ static inline struct page *shmem_read_mapping_page(
 					mapping_gfp_mask(mapping));
 }
 
-static inline bool shmem_file(struct file *file)
-{
-	if (!IS_ENABLED(CONFIG_SHMEM))
-		return false;
-	if (!file || !file->f_mapping)
-		return false;
-	return shmem_mapping(file->f_mapping);
-}
-
 /* Must be called with inode lock taken exclusive. */
 static inline void shmem_freeze(struct inode *inode, bool freeze)
 {
diff --git a/include/linux/userfaultfd_k.h b/include/linux/userfaultfd_k.h
index ebd86677b052..dff9a5c9a0df 100644
--- a/include/linux/userfaultfd_k.h
+++ b/include/linux/userfaultfd_k.h
@@ -153,8 +153,6 @@ extern int mrwprotect_range(struct userfaultfd_ctx *ctx, unsigned long start,
 			    unsigned long len, bool enable_rwp);
 
 /* move_pages */
-void double_pt_lock(spinlock_t *ptl1, spinlock_t *ptl2);
-void double_pt_unlock(spinlock_t *ptl1, spinlock_t *ptl2);
 int move_pages_huge_pmd(struct mm_struct *mm, pmd_t *dst_pmd, pmd_t *src_pmd, pmd_t dst_pmdval,
 			struct vm_area_struct *dst_vma,
 			struct vm_area_struct *src_vma,