Commit d68ce4e71248 for kernel

commit d68ce4e71248e1ff5af9654b407541d9260b3ba5
Merge: 46a062865b6b 71555ae8c757
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Thu Nov 5 13:13:35 2026 -0800

    Merge tag 'mm-core-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/mm/core

    Pull core memory management fixes from David Hildenbrand:
     "Here's a bigger set of MM fixes that we didn't manage to have ready
      for -rc1. All fixes are stable-worthy; the majority fixes nasty
      long-standing bugs instead of being purely hotfixes.

      We have some more of these kinds of stable-worthy fixes in the
      pipeline, but we'll focus on the really urgent fixes as we get closer
      to the release.

      (Leaving urgent MM fixes lurking for various weeks is not good, but
      having too many changes close to the release is also not good, it's
      tricky ...)

      Most issues were reported by Anthropic. Others were found while
      reworking proposed fixes, and of course some of the fixes were just
      reported and fixed on the mailing list.

      All fixes were in linux-next for several days without changes. Some
      commit IDs changed recently when I had to drop some non-stable fixes,
      rebased to -rc1 and picked up more trailers.

      This includes fixes to:
       - THP (Transparent Huge Pages)
       - GUP (Get User Pages)
       - KSM (Kernel Samepage Merging)
       - USERFAULTFD
       - SHARED MEMORY (shmem/tmpfs/memfd)
       - HUGETLB
       - Core MM, PAGE CACHE and MEMORY RECLAIM

      The main changes are:

       - Prevent information leaks through memfd pinning, and out-of bounds
         writes in GUP.

       - Fix data loss in shmem, THP collapse, KSM and memfd pinning.

       - Fix corruption and reference-counting errors with huge PMD/PUD
         mappings, and incorrect TLB flushing and unmapping.

       - Fix various use-after-free bugs, deadlocks and unkillable loops,
         witha a focus on shmem swap handling.

       - Fix execution-seal enforcement for memfd (incl. hugetlb).

      Other changes fix accounting, quota and userfaultfd (un)registration
      handling"

    * tag 'mm-core-7.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/mm/core: (61 commits)
      mm/gup: check folio->mapping under folio lock in memfd_pin_folios()
      khugepaged: fix readahead lock inversion in collapse_file()
      mm/huge_memory: set the mmu_gather page size in zap_huge_pud()
      mm/memory-tiers: unregister empty tiers outside memory_tier_lock
      mm/cma: don't release CMA pages still in use
      mm/vma: don't leak the charge for stack growth
      mm/huge_memory: split huge PUDs when adjusting VMA boundaries
      mm/vma: call ->may_split() before a partial merge
      mm/ksm: check large swap-cache folios before mapping them
      mm/ksm: fix use of a freed anon_vma at swap-in
      mm/ksm: reset the unstable trees of all nodes
      mm: fix deadlock of mremap() against UFFDIO_MOVE
      mm: fix unkillable fault loop on MAP_DROPPABLE memory
      mm: fix unmap_mapping_range() beyond 4 GiB on 32-bit
      mm/memory: reject remote COW faults on PFN mappings
      mm/madvise: fix data loss from MADV_FREE on a KSM page
      mm/mremap: fix moving PUD leaves
      mm/mremap: recheck PUDs under the page table lock
      mm/mremap: use pudp_huge_get_and_clear() when moving huge PUDs
      mm/mmu_notifier: set ->mm only after mmgrab()
      ...

diff --cc mm/hugetlb.c
index ec05e8c1d1f8,84141527fe73..630c96cd1e88
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@@ -5194,14 -5184,13 +5188,12 @@@ static void move_huge_pte(struct vm_are
  		set_huge_pte_at(mm, new_addr, dst_pte, pte, sz);
  	}

- 	if (src_ptl != dst_ptl)
- 		spin_unlock(src_ptl);
- 	spin_unlock(dst_ptl);
+ 	double_pt_unlock(dst_ptl, src_ptl);
  }

 -int move_hugetlb_page_tables(struct vm_area_struct *vma,
 -			     struct vm_area_struct *new_vma,
 -			     unsigned long old_addr, unsigned long new_addr,
 -			     unsigned long len)
 +unsigned long move_hugetlb_page_tables(struct vm_area_struct *vma,
 +		struct vm_area_struct *new_vma, unsigned long old_addr,
 +		unsigned long new_addr, unsigned long len)
  {
  	struct hstate *h = hstate_vma(vma);
  	struct address_space *mapping = vma->vm_file->f_mapping;
diff --cc mm/vma.c
index d416ba58eb4c,695d0be85ac8..e38e22a5e752
--- a/mm/vma.c
+++ b/mm/vma.c
@@@ -532,13 -541,10 +541,11 @@@ __split_vma(struct vma_iterator *vmi, s
  	WARN_ON(vma->vm_start >= addr);
  	WARN_ON(vma->vm_end <= addr);

- 	if (vma->vm_ops && vma->vm_ops->may_split) {
- 		err = vma->vm_ops->may_split(vma, addr);
- 		if (err)
- 			return err;
- 	}
+ 	err = check_split(vma, addr);
+ 	if (err)
+ 		return err;

 +	vma_start_write(vma);
  	new = vm_area_dup(vma);
  	if (!new)
  		return -ENOMEM;