CVE-2026-99159: ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Fix the sub-buffer array base in rbmetasubbufidx()

On a persistent ring buffer, rbmetasubbufidx() can return an index one sub-buffer too high. rbsetupidsmetapage() then fills subbufids[] shifted by one and leaves subbufids[0] NULL, which rbmapvma() dereferences when userspace maps tracepiperaw. rbupdatemetareader() writes two such indices into meta->buffers[], which rbcpumetavalid() would reject on the next boot, discarding the previous boot's trace.

A CPU's sub-buffer array starts after its meta header and the nrsubbufs integers that follow, aligned up to a sub-buffer. rbmetasubbufidx() inverts that calculation but skips only the integers, not the header, so its base is one sub-buffer low whenever the omitted header size crosses the alignment boundary.

Invert the calculation with rbsubbufsfrommeta() rather than repeating it. rbrangebuffer() maps an index back to an address through the same helper, so the two directions can no longer disagree.