6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Tal Zussman [ Upstream commit 1a4aeb6d6a08af1a2e2c52c84170561625819377 ] Commit d68d0c6c3fc7 ("gfs2: Use memcpy_{from,to}_page where appropriate") made the escaped buffer copy read from the mempool page it had just allocated instead of from the buffer, so the block written to the log is whatever the pool page last held. If the journal is replayed after a crash, the block is restored from that and the file's data is corrupted. Only escaped buffers are affected: jdata blocks whose first four bytes match GFS2_MAGIC. Copy from the buffer's folio instead. Fixes: d68d0c6c3fc7 ("gfs2: Use memcpy_{from,to}_page where appropriate") Cc: stable@vger.kernel.org Signed-off-by: Tal Zussman Signed-off-by: Andreas Gruenbacher Signed-off-by: Sasha Levin --- fs/gfs2/lops.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c index 0ed81a685fcd0..59e3d295a2a17 100644 --- a/fs/gfs2/lops.c +++ b/fs/gfs2/lops.c @@ -690,7 +690,9 @@ static void gfs2_before_commit(struct gfs2_sbd *sdp, unsigned int limit, page = mempool_alloc(gfs2_page_pool, GFP_NOIO); p = page_address(page); - memcpy_from_page(p, page, bh_offset(bd2->bd_bh), bd2->bd_bh->b_size); + memcpy_from_folio(p, bd2->bd_bh->b_folio, + bh_offset(bd2->bd_bh), + bd2->bd_bh->b_size); *(__be32 *)p = 0; clear_buffer_escaped(bd2->bd_bh); unlock_buffer(bd2->bd_bh); -- 2.53.0