Re: [PATCH] ext4: turn off DAX on new files when encryption is set

[Eric Biggers]

On Thu, Jul 23, 2026 at 02:26:48PM +0530, Ojaswin Mujoo wrote:
> Currently, when setting the S_ENCRYPTED flag on a new regular inode in
> a -o dax=always mounted FS, we seem to be erroneously retaining the S_DAX
> flag. This is because the newly created inode ends up with the following:
> 
>   __ext4_new_inode()
>     ext4_set_inode_flags(init=true) // sets S_DAX
>       fscrypt_set_context()
>         ext4_set_context()
>           ext4_set_inode_flags(init=false) // sets S_ENCRYPTED but
>                                               doesn't clears S_DAX
>       ext4_set_aops
>         inode->i_mapping->a_ops = &ext4_dax_aops;
> 
> Due to the S_DAX flag, the excrypted inode gets ext4_dax_aops and it
> silently ends up bypassing encryption completely. This is reflected in
> multiple xfstests failures like generic/548. To fix this, ensure we disable
> S_DAX correctly when S_ENCRYPTED is being set on a newly created inode. It
> is safe to change DAX state there because ext4_set_aops() later can
> correctly detect S_DAX unset and assign the correct aops.
> 
> The fix was actually the intended behavior however it seemed to have
> silently changed in 043546e46dc7.
> 
> Fixes: 043546e46dc7 ("fs/ext4: Only change S_DAX on inode load")
> Reported-by: Disha Goel <disgoel@xxxxxxxxxxxxx>
> Signed-off-by: Ojaswin Mujoo <ojaswin@xxxxxxxxxxxxx>

Acked-by: Eric Biggers <ebiggers@xxxxxxxxxx>

I'm glad I wrote those tests like generic/548, which verify that files
are actually being encrypted on-disk...

Looking for other potential encryption bypasses in ext4, I think
ext4_iomap_swap_activate() needs a fix as well to reject encrypted files
(perhaps in the caller).  That would be a separate patch though.

- Eric