From: Yin Tirui <yintirui@huawei.com> stable inclusion from stable-v5.10.259 commit 84b3212b166b446faea27ebebb7161405ffceef9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15875 CVE: CVE-2026-53189 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- [ Upstream commit 8d878059924f12c1bc24556a92ec56add74de3c8 ] __split_huge_pmd_locked() updates the file/shmem RSS counter after dropping the PMD mapping's folio reference. If folio_put() drops the last reference, mm_counter_file() can later read freed folio state via folio_test_swapbacked(). Move the counter update before folio_put(). Link: https://lore.kernel.org/20260526101337.1984081-1-yintirui@huawei.com Fixes: fadae2953072 ("thp: use mm_file_counter to determine update which rss counter") Signed-off-by: Yin Tirui <yintirui@huawei.com> Reviewed-by: Lorenzo Stoakes <ljs@kernel.org> Acked-by: David Hildenbrand (arm) <david@kernel.org> Reviewed-by: Lance Yang <lance.yang@linux.dev> Reviewed-by: Dev Jain <dev.jain@arm.com> Cc: Baolin Wang <baolin.wang@linux.alibaba.com> Cc: Barry Song <baohua@kernel.org> Cc: Chen Jun <chenjun102@huawei.com> Cc: Kefeng Wang <wangkefeng.wang@huawei.com> Cc: Liam R. Howlett <liam@infradead.org> Cc: Nico Pache <npache@redhat.com> Cc: Ryan Roberts <ryan.roberts@arm.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Yang Shi <yang.shi@linux.alibaba.com> Cc: Zi Yan <ziy@nvidia.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Conflicts: mm/huge_memory.c [Just context conflicts] Signed-off-by: Zhang Qilong <zhangqilong3@huawei.com> --- mm/huge_memory.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 2825c5390fe9..261eefa41fa1 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -2038,11 +2038,13 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd, set_page_dirty(page); if (!PageReferenced(page) && pmd_young(old_pmd)) SetPageReferenced(page); reliable_page_counter(page, mm, -HPAGE_PMD_NR); page_remove_rmap(page, true); + add_mm_counter(mm, mm_counter_file(page), -HPAGE_PMD_NR); put_page(page); + return; } add_mm_counter(mm, mm_counter_file(page), -HPAGE_PMD_NR); return; } -- 2.43.0