mm/smaps: fix race between smaps_hugetlb_range and migration

smaps_hugetlb_range() handles the pte without holdling ptl, and may be
concurrenct with migration, leaing to BUG_ON in pfn_swap_entry_to_page().
The race is as follows.

smaps_hugetlb_range migrate_pages
huge_ptep_get
remove_migration_ptes
folio_unlock
pfn_swap_entry_folio
BUG_ON

To fix it, hold ptl lock in smaps_hugetlb_range().

Link: https://lkml.kernel.org/r/[e-mail]
Link: https://lkml.kernel.org/r/[e-mail]
Fixes: 25ee01a2fca0 ("mm: hugetlb: proc: add hugetlb-related fields to /proc/PID/smaps")
Signed-off-by: Jinjiang Tu <[e-mail]>
Acked-by: David Hildenbrand <[e-mail]>
Cc: Andrei Vagin <[e-mail]>
Cc: Andrii Nakryiko <[e-mail]>
Cc: Baolin Wang <[e-mail]>
Cc: Brahmajit Das <[e-mail]>
Cc: Catalin Marinas <[e-mail]>
Cc: Christophe Leroy <[e-mail]>
Cc: David Rientjes <[e-mail]>
Cc: Dev Jain <[e-mail]>
Cc: Hugh Dickins <[e-mail]>
Cc: Joern Engel <[e-mail]>
Cc: Kefeng Wang <[e-mail]>
Cc: Lorenzo Stoakes <[e-mail]>
Cc: Michal Hocko <[e-mail]>
Cc: Ryan Roberts <[e-mail]>
Cc: Thiago Jung Bauermann <[e-mail]>
Signed-off-by: Andrew Morton <[e-mail]>

fs/proc/task_mmu.c

···
 {
 	struct mem_size_stats *mss = walk->private;
 	struct vm_area_struct *vma = walk->vma;
-	pte_t ptent = huge_ptep_get(walk->mm, addr, pte);
 	struct folio *folio = NULL;
 	bool present = false;
+	spinlock_t *ptl;
+	pte_t ptent;
 
+	ptl = huge_pte_lock(hstate_vma(vma), walk->mm, pte);
+	ptent = huge_ptep_get(walk->mm, addr, pte);
 	if (pte_present(ptent)) {
 		folio = page_folio(pte_page(ptent));
 		present = true;
···
 		else
 			mss->private_hugetlb += huge_page_size(hstate_vma(vma));
 	}
+	spin_unlock(ptl);
 	return 0;
 }
 #else