CVE-2024-49964

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: fix memfdpinfolios freehugepages leak

memfdpinfolios followed by unpinfolios fails to restore freehugepages if the pages were not already faulted in, because the folio refcount for pages created by memfdallocfolio never goes to 0. memfdpinfolios needs another folioput to undo the foliotryget below:

memfdallocfolio() allochugetlbfolionodemask() dequeuehugetlbfolionodemask() dequeuehugetlbfolionodeexact() foliorefunfreeze(folio, 1); ; adds 1 refcount foliotryget() ; adds 1 refcount hugetlbaddtopagecache() ; adds 512 refcount (on x86)

With the fix, after memfdpinfolios + unpin_folios, the refcount for the (unfaulted) page is 512, which is correct, as the refcount for a faulted unpinned page is 513.