Re: [PATCH] gfs2: fix the escaped block copy in gfs2_before_commit()

[Andreas Gruenbacher]

On Thu, Oct 15, 2026 at 2:37 AM Tal Zussman <tz2294@xxxxxxxxxxxx> wrote:
> Commit d68d0c6c3fc7 ("gfs2: Use memcpy_{from,to}_page where
> appropriate") made the escaped buffer copy read from the mempool page
> it had just allocated instead of from the buffer, so the block written
> to the log is whatever the pool page last held. If the journal is
> replayed after a crash, the block is restored from that and the file's
> data is corrupted. Only escaped buffers are affected: jdata blocks
> whose first four bytes match GFS2_MAGIC. Copy from the buffer's folio
> instead.
>
> Fixes: d68d0c6c3fc7 ("gfs2: Use memcpy_{from,to}_page where appropriate")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Tal Zussman <tz2294@xxxxxxxxxxxx>
> ---
>  fs/gfs2/lops.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/fs/gfs2/lops.c b/fs/gfs2/lops.c
> index 77ef22eab368..16fba2108a4f 100644
> --- a/fs/gfs2/lops.c
> +++ b/fs/gfs2/lops.c
> @@ -689,7 +689,9 @@ static void gfs2_before_commit(struct gfs2_sbd *sdp, unsigned int limit,
>
>                                 page = mempool_alloc(gfs2_page_pool, GFP_NOIO);
>                                 p = page_address(page);
> -                               memcpy_from_page(p, page, bh_offset(bd2->bd_bh), bd2->bd_bh->b_size);
> +                               memcpy_from_folio(p, bd2->bd_bh->b_folio,
> +                                                 bh_offset(bd2->bd_bh),
> +                                                 bd2->bd_bh->b_size);
>                                 *(__be32 *)p = 0;
>                                 clear_buffer_escaped(bd2->bd_bh);
>                                 unlock_buffer(bd2->bd_bh);
>
> ---
> base-commit: d0c4bce31a579216780b990a09250f15e00f38ff
> change-id: 20261014-gfs2-escaped-copy-fix-1055ded37add
>
> Best regards,
> --
> Tal Zussman <tz2294@xxxxxxxxxxxx>

Thanks, I've applied this to for-next.

Andreas