[GIT PULL] Core MM updates for 7.4-rc2

[GIT PULL] Core MM updates for 7.4-rc2

[David Hildenbrand (Arm)]

Hi Linus,

as discussed via mail, here is a bigger set of MM fixes that we didn't
manage to have ready for -rc1. All fixes are stable-worthy; the majority
fixes nasty long-standing bugs instead of being purely hotfixes.

We have some more of these kinds of stable-worthy fixes in the pipeline,
but we'll focus on the really urgent fixes as we get closer to the release.

(leaving urgent MM fixes lurking for various weeks is not good,
but having too many changes close to the release is also not good, it's
tricky ...)

Most issues were reported by Anthropic. Others were found while reworking
proposed fixes, and of course some of the fixes were just reported and
fixed on the mailing list.

All fixes were in linux-next for several days without changes. Some commit
IDs changed recently when I had to drop some non-stable fixes, rebased to
-rc1 and picked up more trailers.

Please let me know if anything looks odd or if you would prefer things
differently going forward. I'm still learning while dealing with all the
bugs we're finding.

Cheers,

David

----------------------------------------------------------------

The following changes since commit 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4:

  Linux 7.4-rc1 (2026-11-01 13:26:31 -0800)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/mm/core.git tags/mm-core-7.4-rc2

for you to fetch changes up to 71555ae8c7572fd99158013ca2e29187c5d2508d:

  mm/gup: check folio->mapping under folio lock in memfd_pin_folios() (2026-11-03 20:20:53 +0100)

----------------------------------------------------------------
Core memory management fixes for 7.4-rc2

This includes fixes to:

 - THP (Transparent Huge Pages)
 - GUP (Get User Pages)
 - KSM (Kernel Samepage Merging)
 - USERFAULTFD
 - SHARED MEMORY (shmem/tmpfs/memfd)
 - HUGETLB
 - Core MM, PAGE CACHE and MEMORY RECLAIM

The main changes are:

 - Prevent information leaks through memfd pinning, and out-of
   bounds writes in GUP.

 - Fix data loss in shmem, THP collapse, KSM and memfd pinning.

 - Fix corruption and reference-counting errors with huge PMD/PUD
   mappings, and incorrect TLB flushing and unmapping.

 - Fix various use-after-free bugs, deadlocks and unkillable loops,
   witha a focus on shmem swap handling.

 - Fix execution-seal enforcement for memfd (incl. hugetlb).

Other changes fix accounting, quota and userfaultfd (un)registration
handling.

Signed-off-by: David Hildenbrand (Arm) <david@kernel.org>

----------------------------------------------------------------
Chris Mason (15):
      mm/mempolicy: charge shared policy nodes
      mm/shmem: honour F_SEAL_EXEC when an ACL is set
      mm/shmem: stop retrying folios that cannot be split
      mm/shmem: preserve data in clean folios when splitting fails
      mm/huge_memory: fix truncate racing with PMD zapping
      mm/huge_memory: fix zapping migration entries for device-private THPs
      mm/khugepaged: preserve dirty bits when collapsing PTE-mapped THPs
      mm/gup: fix clearing folios in memfd_pin_folios()
      mm/gup: fix out-of-bounds write for nr_pages == 0 in GUP-fast
      mm/mmu_notifier: set ->mm only after mmgrab()
      mm/memory: reject remote COW faults on PFN mappings
      mm: fix unkillable fault loop on MAP_DROPPABLE memory
      mm: fix deadlock of mremap() against UFFDIO_MOVE
      mm/ksm: check large swap-cache folios before mapping them
      mm/vma: call ->may_split() before a partial merge

David Hildenbrand (Arm) (26):
      mm/shmem: discard whole new large folios on fallocate rollback
      mm/shmem: rescan after nonuniform folio splitting
      mm/shmem: fix truncate hang in large swap entry
      mm/shmem: preserve allocation errors when swapping in large entries
      mm/shmem: fix truncate loop after boundary swapin failure
      mm/shmem: fix accounting of swapin-error markers
      mm/shmem: fix truncation of files containing only swapin-error markers
      fork: take mmap_lock before copying mm_struct
      mm/shmem: make shmem_file() check the file's inode
      mm/truncate: look again if a folio left the mapping
      mm/filemap: finish fault cleanup before dropping the fault lock
      mm/rmap: handle device-exclusive entries in folio_referenced_one()
      mm/huge_memory: fix list corruption when deferred_split_scan() races with deferred_split_folio()
      mm/huge_memory: properly handle refcounted PUD mappings on fork
      mm/gup: recheck the PUD under PTL in follow_pud_mask()
      mm/gup: check for overflow when converting nr_pages to bytes in GUP-fast
      mm/userfaultfd: write-lock the VMA before waking waiters when unregistering
      mm/userfaultfd: wake waiters when registration modes are removed
      mm/mremap: use pudp_huge_get_and_clear() when moving huge PUDs
      mm/mremap: recheck PUDs under the page table lock
      mm/madvise: fix data loss from MADV_FREE on a KSM page
      mm/ksm: reset the unstable trees of all nodes
      mm/ksm: fix use of a freed anon_vma at swap-in
      mm/huge_memory: split huge PUDs when adjusting VMA boundaries
      mm/vma: don't leak the charge for stack growth
      mm/memory-tiers: unregister empty tiers outside memory_tier_lock

Eva Kurchatova (1):
      hugetlbfs: enforce F_SEAL_EXEC in setattr

Gregory Price (1):
      mm/userfaultfd: compare exact registration modes before skipping

Josef Bacik (14):
      tmpfs: keep the quota soft limits of an unused id
      tmpfs: preserve explicitly disabled quota limits
      mm/shmem: hold off eviction in shmem_writeout()
      mm/mglru: don't use stack pointers when walking PUD and PMD tables
      mm/memfd: make f_pos accesses atomic
      mm/filemap: read mapping->a_ops->free_folio under i_lock
      mm/filemap: don't lose a folio lock wakeup to a signal
      mm/khugepaged: always recheck the pmd in try_collapse_pte_mapped_thp()
      mm/khugepaged: fix PMD table lock leak in try_collapse_pte_mapped_thp()
      mm/userfaultfd: wake all waiters on unregister
      mm/mmu_gather: fix flushing ranges with 4 GiB or larger
      mm/mmu_notifier: finish non-blocking interval invalidation on error
      mm/mremap: fix moving PUD leaves
      mm: fix unmap_mapping_range() beyond 4 GiB on 32-bit

Lance Yang (1):
      khugepaged: fix readahead lock inversion in collapse_file()

Rik van Riel (1):
      mm/cma: don't release CMA pages still in use

Ritesh Harjani (IBM) (1):
      mm/huge_memory: set the mmu_gather page size in zap_huge_pud()

Samiullah Khawaja (1):
      mm/gup: check folio->mapping under folio lock in memfd_pin_folios()

 fs/hugetlbfs/inode.c          |   8 ++
 include/asm-generic/tlb.h     |   3 +-
 include/linux/huge_mm.h       |   5 +-
 include/linux/ksm.h           |   6 +-
 include/linux/memfd.h         |   9 +++
 include/linux/mmu_notifier.h  |   3 +-
 include/linux/shmem_fs.h      |  15 ++--
 include/linux/userfaultfd_k.h |   2 -
 kernel/fork.c                 |  20 +++--
 mm/cma.c                      |  10 ++-
 mm/filemap.c                  |  84 ++++++++++----------
 mm/gup.c                      |  68 ++++++++++++-----
 mm/huge_memory.c              | 146 ++++++++++++++++++++++++++---------
 mm/hugetlb.c                  |  14 +---
 mm/internal.h                 |  28 +++++++
 mm/khugepaged.c               |  65 +++++++++++-----
 mm/ksm.c                      |  56 ++++++++++----
 mm/madvise.c                  |   9 +++
 mm/memfd.c                    |   2 +
 mm/memory-tiers.c             |  29 ++++---
 mm/memory.c                   |  30 +++++---
 mm/mempolicy.c                |   4 +-
 mm/mmap.c                     |   8 +-
 mm/mmu_notifier.c             |  24 ++++--
 mm/mremap.c                   | 103 +++++++++++--------------
 mm/nommu.c                    |   2 +-
 mm/rmap.c                     |  23 +++++-
 mm/shmem.c                    | 173 +++++++++++++++++++++++++++++-------------
 mm/shmem_quota.c              |  28 +++----
 mm/swapfile.c                 |   3 +-
 mm/truncate.c                 |  13 +++-
 mm/userfaultfd.c              |  75 +++++++++---------
 mm/util.c                     |  13 ++++
 mm/vma.c                      |  24 ++++--
 mm/vmscan.c                   |   4 +-
 35 files changed, 717 insertions(+), 392 deletions(-)