Merge: CVE-2025-37958 mm/huge_memory: fix dereferencing invalid pmd migration entry

MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/7001

JIRA: https://issues.redhat.com/browse/RHEL-96372
CVE: CVE-2025-37958

```
    When migrating a THP, concurrent access to the PMD migration entry during
    a deferred split scan can lead to an invalid address access, as
    illustrated below.  To prevent this invalid access, it is necessary to
    check the PMD migration entry and return early.  In this context, there is
    no need to use pmd_to_swp_entry and pfn_swap_entry_to_page to verify the
    equality of the target folio.  Since the PMD migration entry is locked, it
    cannot be served as the target.
```

Signed-off-by: Rafael Aquini <raquini@redhat.com>

Approved-by: Donald Dutile <ddutile@redhat.com>
Approved-by: Luiz Capitulino <luizcap@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: Augusto Caringi <acaringi@redhat.com>

Author: caringi

mm/huge_memory.c

@@ -2312,6 +2312,7 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
 {
 	spinlock_t *ptl;
 	struct mmu_notifier_range range;
+	bool pmd_migration;
 
 	mmu_notifier_range_init(&range, MMU_NOTIFY_CLEAR, 0, vma->vm_mm,
 				address & HPAGE_PMD_MASK,
@@ -2326,13 +2327,13 @@ void __split_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd,
 	VM_BUG_ON(freeze && !folio);
 	VM_WARN_ON_ONCE(folio && !folio_test_locked(folio));
 
-	if (pmd_trans_huge(*pmd) || pmd_devmap(*pmd) ||
-	    is_pmd_migration_entry(*pmd)) {
+	pmd_migration = is_pmd_migration_entry(*pmd);
+	if (pmd_trans_huge(*pmd) || pmd_devmap(*pmd) || pmd_migration) {
 		/*
-		 * It's safe to call pmd_page when folio is set because it's
-		 * guaranteed that pmd is present.
+		 * Do not apply pmd_folio() to a migration entry; and folio lock
+		 * guarantees that it must be of the wrong folio anyway.
 		 */
-		if (folio && folio != page_folio(pmd_page(*pmd)))
+		if (folio && (pmd_migration || folio != page_folio(pmd_page(*pmd))))
 			goto out;
 		__split_huge_pmd_locked(vma, pmd, range.start, freeze);
 	}