tmpfs fixes close F_SEAL_EXEC bypass and truncation hangs

David Hildenbrand has posted a batch of tmpfs and shmem fixes aimed at a security hole in sealed memfds, unkillable truncation hangs, and broken swap accounting, with several of the more urgent changes marked for stable kernels.

The highest-profile flaw lets the owner of a memfd sealed with F_SEAL_EXEC flip execute bits through a POSIX access ACL when tmpfs ACL support is enabled, defeating vm.memfd_noexec=2. The same seal was also missing from hugetlbfs attribute handling, so fchmod could revive execute permission on a sealed hugetlb memfd. Both paths now share a common seal check so mode changes that touch execute bits are rejected.

Separately, truncating or hole-punching tmpfs files and memfds could spin forever inside the range-undo logic while holding the inode lock, so the task could not be killed. Triggers included large swap entries straddling the new EOF, failed splits of large folios, and swap-in failures at the truncation boundary. Related fixes stop the final scan from walking start backwards after a partial split, mark large folios dirty before partial truncate so clean folio fallback cannot drop live data outside the hole, and fully discard folios when rolling back a failed fallocate instead of only trimming them.

Writeback had a use-after-free: once a folio moved from the page cache into the swap cache, reclaim no longer pinned the inode, yet shmem could still touch the mapping after swap_writeout reactivated the folio (notably when zswap refused the store). Eviction now waits out in-flight writeout. Quota handling lost soft limits and explicitly disabled limits when dquot records were dropped and later rebuilt from mount defaults, so administrators could see EDQUOT after they had turned enforcement off.

Swap-in error markers could underflow shmem counters and confuse swapoff; installing a marker now drops only the swapped count and lets ordinary recalculation release block charge. Hildenbrand called shmem and swap interaction "a nightmare" and left further large-swap split cases as known follow-up work, noting that allocation failure during truncate still does not always zero the boundary correctly.