mm: call ->free_folio() directly in folio_unmap_invalidate()

In the Linux kernel, the following vulnerability has been resolved:

mm: call ->free_folio() directly in folio_unmap_invalidate()

We can only call filemap_free_folio() if we have a reference to (or hold a

lock on) the mapping. Otherwise, we've already removed the folio from the

mapping so it no longer pins the mapping and the mapping can be removed,

causing a use-after-free when accessing mapping->a_ops.

Follow the same pattern as __remove_mapping() and load the free_folio

function pointer before dropping the lock on the mapping. That lets us

make filemap_free_folio() static as this was the only caller outside

filemap.c.