CVE-2026-98226: mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count

In the Linux kernel, the following vulnerability has been resolved:

mm, swap: fix SWAPUSAGEOFFLISTBIT collision with real usage count

SWAPUSAGEOFFLISTBIT is embedded in the si->inusepages usage counter, and is meant to sit above any value that counter can reach. However, it is defined from BITSPERTYPE(atomict), so it is bit 30. On a system with 4 KiB pages the flag collides with the usage count once that count reaches 4 TiB.

swapusageinpages() masks bit 30 out, so whenever the real count has that bit set, every caller of it reads 4 TiB low:

/proc/swaps understates Used by 4 TiB.

A raw count of exactly 2^30 masks to zero, so trytounuse() takes its "if (!swapusageinpages(si)) goto success;" early exit and swapoff tears the device down while pages are still swapped out. Nothing in the rest of swapoff aborts the teardown, so those pages are lost.

Independently of swapoff, the collision also corrupts the counter and the plist. On a device in normal use, a free that leaves bit 30 set in the count makes swapusagesub() see the flag where there is only count, and call addtoavaillist(). It clears the bit with fetchand(~SWAPUSAGEOFFLISTBIT), leaving the stored count 4 TiB below the real one, and calls plistadd() on a device that is already listed, tripping the WARNON(!plistnodeempty(node)) in plistadd() and linking the node a second time.

Change the definition of SWAPUSAGEOFFLISTBIT to be based on atomiclongt instead. Note that the usage counter field itself is of this same type, so it is still a valid bit.