f2fs_add_fsync_node_entry() numbers each fsync'd warm node page with sbi->fsync_seg_id++, and f2fs_reset_fsync_node_info() sets the counter back to 0 at every checkpoint. The first node page fsync'd after a checkpoint therefore gets seq_id 0, which f2fs_do_sync_file() passes to f2fs_wait_on_node_pages_writeback(). That function treats 0 as "nothing to wait for": while (seq_id && cur_seq_id < seq_id) { so the fsync issues its cache flush without waiting for its own node page. If the flush completes before the node write, the inode's fsync-marked node block (needed by roll-forward recovery) is not covered by the flush, and a power loss can lose data that fsync reported as durable. In our traces the first fsync after a checkpoint returned before its node write completed in many trials. Start the numbering at 1, so that 0 keeps meaning "no node page written". Testing (kernel 7.0.0-42, f2fs built as a module from the same source, QEMU/KVM, block-layer FLUSH/FUA model with dm-log-writes replay): - block traces, append+fsync after sync: FLUSH issued before the node write completed in 29/30 first fsyncs unpatched, 0/30 patched; never for later fsyncs; - crash-state replay (28 cells x 3 recordings per module): SQLite WAL/TRUNCATE/PERSIST, LevelDB, RocksDB, LMDB and an append log lose acknowledged commits or become unopenable in 24 cells unpatched, and are clean in all of them patched. The same code is present in Android GKI android12-5.10 through android15-6.6 and in the f2fs dev tree as of 2026-11-02. Fixes: 50fa53eccf9f ("f2fs: fix to avoid broken of dnode block list") Cc: stable@vger.kernel.org Signed-off-by: Seungbum Ju --- fs/f2fs/node.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c index 1234567..89abcdef 100644 --- a/fs/f2fs/node.c +++ b/fs/f2fs/node.c @@ -361,7 +361,7 @@ static unsigned int f2fs_add_fsync_node_entry(struct f2fs_sb_info *sbi, spin_lock_irqsave(&sbi->fsync_node_lock, flags); list_add_tail(&fn->list, &sbi->fsync_node_list); - fn->seq_id = sbi->fsync_seg_id++; + fn->seq_id = ++sbi->fsync_seg_id; seq_id = fn->seq_id; sbi->fsync_node_num++; spin_unlock_irqrestore(&sbi->fsync_node_lock, flags); -- 2.45.0