buffer: read the folio's mapping directly in buffer_set_crypto_ctx()

folio_mapping() was doing two jobs here.  One was to turn a slab folio into
NULL, which is what made this safe for jbd2's shadow buffers; the previous
patch removed the need for that by giving those buffers no folio at all.

The other is a hazard.  folio_mapping() maps a folio in the swap cache to
its swap_address_space, so if a buffer_head were ever attached to such a
folio this would hand fscrypt a swap mapping and dereference ->host on it.
There is no reason to want that here: this path wants the file's mapping or
nothing.

Read ->mapping directly.  Buffers with no folio are already handled above.

Suggested-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Acked-by: Weidong Zhu <weizhu@fiu.edu>
Signed-off-by: Chao Shi <coshi036@gmail.com>
Link: https://patch.msgid.link/3fe72ec37bf8491a69031db5f3ba1319da935b97.1785951556.git.coshi036@gmail.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
This commit is contained in:
Chao Shi 2026-08-06 12:58:27 -04:00 committed by Christian Brauner
parent 3c9ab45852
commit 8775d14a90
No known key found for this signature in database
GPG Key ID: 91C61BC06578DCA2

View File

@ -1079,7 +1079,7 @@ static void buffer_set_crypto_ctx(struct bio *bio, const struct buffer_head *bh,
*/
if (!bh->b_folio)
return;
mapping = folio_mapping(bh->b_folio);
mapping = bh->b_folio->mapping;
if (!mapping)
return;
fscrypt_set_bio_crypt_ctx(bio, mapping->host,