Commit d68d0c6c3fc7 ("gfs2: Use memcpy_{from,to}_page where appropriate") made the escaped buffer copy read from the mempool page it had just allocated instead of from the buffer, so the block written to the log is whatever the pool page last held. If the journal is replayed after a crash, the block is restored from that and the file's data is corrupted. Only escaped buffers are affected: jdata blocks whose first four bytes match GFS2_MAGIC. Copy from the buffer's folio instead. Fixes: d68d0c6c3fc7 ("gfs2: Use memcpy_{from,to}_page where appropriate") Cc: stable@vger.kernel.org Signed-off-by: Tal Zussman --- fs/gfs2/lops.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c index 77ef22eab368..16fba2108a4f 100644 --- a/fs/gfs2/lops.c +++ b/fs/gfs2/lops.c @@ -689,7 +689,9 @@ static void gfs2_before_commit(struct gfs2_sbd *sdp, unsigned int limit, page = mempool_alloc(gfs2_page_pool, GFP_NOIO); p = page_address(page); - memcpy_from_page(p, page, bh_offset(bd2->bd_bh), bd2->bd_bh->b_size); + memcpy_from_folio(p, bd2->bd_bh->b_folio, + bh_offset(bd2->bd_bh), + bd2->bd_bh->b_size); *(__be32 *)p = 0; clear_buffer_escaped(bd2->bd_bh); unlock_buffer(bd2->bd_bh); --- base-commit: d0c4bce31a579216780b990a09250f15e00f38ff change-id: 20261014-gfs2-escaped-copy-fix-1055ded37add Best regards, -- Tal Zussman