Merge 4.4.171 into android-4.4

Changes in 4.4.171
	ALSA: hda/realtek - Disable headset Mic VREF for headset mode of ALC225
	btrfs: cleanup, stop casting for extent_map->lookup everywhere
	btrfs: Enhance chunk validation check
	Btrfs: add validadtion checks for chunk loading
	Btrfs: check inconsistence between chunk and block group
	Btrfs: fix em leak in find_first_block_group
	Btrfs: detect corruption when non-root leaf has zero item
	Btrfs: check btree node's nritems
	Btrfs: fix BUG_ON in btrfs_mark_buffer_dirty
	Btrfs: memset to avoid stale content in btree node block
	Btrfs: improve check_node to avoid reading corrupted nodes
	Btrfs: kill BUG_ON in run_delayed_tree_ref
	Btrfs: memset to avoid stale content in btree leaf
	Btrfs: fix emptiness check for dirtied extent buffers at check_leaf()
	btrfs: struct-funcs, constify readers
	btrfs: Refactor check_leaf function for later expansion
	btrfs: Check if item pointer overlaps with the item itself
	btrfs: Add sanity check for EXTENT_DATA when reading out leaf
	btrfs: Add checker for EXTENT_CSUM
	btrfs: Move leaf and node validation checker to tree-checker.c
	btrfs: tree-checker: Enhance btrfs_check_node output
	btrfs: tree-checker: Fix false panic for sanity test
	btrfs: tree-checker: Add checker for dir item
	btrfs: tree-checker: use %zu format string for size_t
	btrfs: tree-check: reduce stack consumption in check_dir_item
	btrfs: tree-checker: Verify block_group_item
	btrfs: tree-checker: Detect invalid and empty essential trees
	btrfs: validate type when reading a chunk
	btrfs: Check that each block group has corresponding chunk at mount time
	btrfs: Verify that every chunk has corresponding block group at mount time
	btrfs: tree-checker: Check level for leaves and nodes
	btrfs: tree-checker: Fix misleading group system information
	CIFS: Do not hide EINTR after sending network packets
	cifs: Fix potential OOB access of lock element array
	usb: cdc-acm: send ZLP for Telit 3G Intel based modems
	USB: storage: don't insert sane sense for SPC3+ when bad sense specified
	USB: storage: add quirk for SMI SM3350
	USB: Add USB_QUIRK_DELAY_CTRL_MSG quirk for Corsair K70 RGB
	slab: alien caches must not be initialized if the allocation of the alien cache failed
	PCI: altera: Fix altera_pcie_link_is_up()
	PCI: altera: Reorder read/write functions
	PCI: altera: Check link status before retrain link
	PCI: altera: Poll for link up status after retraining the link
	PCI: altera: Poll for link training status after retraining the link
	PCI: altera: Rework config accessors for use without a struct pci_bus
	PCI: altera: Move retrain from fixup to altera_pcie_host_init()
	ACPI: power: Skip duplicate power resource references in _PRx
	i2c: dev: prevent adapter retries and timeout being set as minus value
	crypto: cts - fix crash on short inputs
	ext4: fix a potential fiemap/page fault deadlock w/ inline_data
	sunrpc: use-after-free in svc_process_common()
	Linux 4.4.171

Change-Id: If59c94897d4f135b24d45772a7db116503695ba7
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

1 files changed, 30 insertions, 13 deletions

diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index 7de8d545f4d6..573c9d62cfc9 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -3847,8 +3847,10 @@ static noinline_for_stack int write_one_eb(struct extent_buffer *eb,
 	struct block_device *bdev = fs_info->fs_devices->latest_bdev;
 	struct extent_io_tree *tree = &BTRFS_I(fs_info->btree_inode)->io_tree;
 	u64 offset = eb->start;
+	u32 nritems;
 	unsigned long i, num_pages;
 	unsigned long bio_flags = 0;
+	unsigned long start, end;
 	int rw = (epd->sync_io ? WRITE_SYNC : WRITE) | REQ_META;
 	int ret = 0;
 
@@ -3858,6 +3860,23 @@ static noinline_for_stack int write_one_eb(struct extent_buffer *eb,
 	if (btrfs_header_owner(eb) == BTRFS_TREE_LOG_OBJECTID)
 		bio_flags = EXTENT_BIO_TREE_LOG;
 
+	/* set btree blocks beyond nritems with 0 to avoid stale content. */
+	nritems = btrfs_header_nritems(eb);
+	if (btrfs_header_level(eb) > 0) {
+		end = btrfs_node_key_ptr_offset(nritems);
+
+		memset_extent_buffer(eb, 0, end, eb->len - end);
+	} else {
+		/*
+		 * leaf:
+		 * header 0 1 2 .. N ... data_N .. data_2 data_1 data_0
+		 */
+		start = btrfs_item_nr_offset(nritems);
+		end = btrfs_leaf_data(eb) +
+		      leaf_data_end(fs_info->tree_root, eb);
+		memset_extent_buffer(eb, 0, start, end - start);
+	}
+
 	for (i = 0; i < num_pages; i++) {
 		struct page *p = eb->pages[i];
 
@@ -5351,9 +5370,8 @@ unlock_exit:
 	return ret;
 }
 
-void read_extent_buffer(struct extent_buffer *eb, void *dstv,
-			unsigned long start,
-			unsigned long len)
+void read_extent_buffer(const struct extent_buffer *eb, void *dstv,
+			unsigned long start, unsigned long len)
 {
 	size_t cur;
 	size_t offset;
@@ -5382,9 +5400,9 @@ void read_extent_buffer(struct extent_buffer *eb, void *dstv,
 	}
 }
 
-int read_extent_buffer_to_user(struct extent_buffer *eb, void __user *dstv,
-			unsigned long start,
-			unsigned long len)
+int read_extent_buffer_to_user(const struct extent_buffer *eb,
+			       void __user *dstv,
+			       unsigned long start, unsigned long len)
 {
 	size_t cur;
 	size_t offset;
@@ -5419,10 +5437,10 @@ int read_extent_buffer_to_user(struct extent_buffer *eb, void __user *dstv,
 	return ret;
 }
 
-int map_private_extent_buffer(struct extent_buffer *eb, unsigned long start,
-			       unsigned long min_len, char **map,
-			       unsigned long *map_start,
-			       unsigned long *map_len)
+int map_private_extent_buffer(const struct extent_buffer *eb,
+			      unsigned long start, unsigned long min_len,
+			      char **map, unsigned long *map_start,
+			      unsigned long *map_len)
 {
 	size_t offset = start & (PAGE_CACHE_SIZE - 1);
 	char *kaddr;
@@ -5457,9 +5475,8 @@ int map_private_extent_buffer(struct extent_buffer *eb, unsigned long start,
 	return 0;
 }
 
-int memcmp_extent_buffer(struct extent_buffer *eb, const void *ptrv,
-			  unsigned long start,
-			  unsigned long len)
+int memcmp_extent_buffer(const struct extent_buffer *eb, const void *ptrv,
+			 unsigned long start, unsigned long len)
 {
 	size_t cur;
 	size_t offset;