CVE-2026-53162: memcg: use round-robin victim selection in refill_stock

In the Linux kernel, the following vulnerability has been resolved:

memcg: use round-robin victim selection in refillstock

Harry Yoo reported that getrandomu32below() is not safe to call in the nmi context and memcg charge draining can happen in nmi context.

More specifically getrandomu32below() is neither reentrant- nor NMI-safe: it acquires a per-cpu locallock via locallockirqsave() on the batchedentropyu32 state. An NMI that lands on a CPU mid-update of the ChaCha batch state and recurses into the random subsystem would corrupt that state. The memcgstock localtrylock prevents re-entry on the percpu stock itself, but cannot protect an unrelated subsystem's per-cpu lock.

Replace the random pick with a per-cpu round-robin counter stored in memcgstockpcp and serialized by the same localtrylock that already guards cached[] and nrpages[]. No atomics, no random calls, no extra locks needed.