Merge android-4.4.187 (8eb3d65) into msm-4.4

* refs/heads/tmp-8eb3d65
  Linux 4.4.187
  ceph: hold i_ceph_lock when removing caps for freeing inode
  drivers/pps/pps.c: clear offset flags in PPS_SETPARAMS ioctl
  sched/fair: Don't free p->numa_faults with concurrent readers
  Bluetooth: hci_uart: check for missing tty operations
  media: radio-raremono: change devm_k*alloc to k*alloc
  media: cpia2_usb: first wake up, then free in disconnect
  ISDN: hfcsusb: checking idx of ep configuration
  tcp: reset sk_send_head in tcp_write_queue_purge
  ipv6: check sk sk_type and protocol early in ip_mroute_set/getsockopt
  mm, vmstat: make quiet_vmstat lighter
  vmstat: Remove BUG_ON from vmstat_update
  access: avoid the RCU grace period for the temporary subjective credentials
  powerpc/tm: Fix oops on sigreturn on systems without TM
  ALSA: hda - Add a conexant codec entry to let mute led work
  ALSA: line6: Fix wrong altsetting for LINE6_PODHD500_1
  hpet: Fix division by zero in hpet_time_div()
  x86/speculation/mds: Apply more accurate check on hypervisor platform
  x86/sysfb_efi: Add quirks for some devices with swapped width and height
  usb: pci-quirks: Correct AMD PLL quirk detection
  usb: wusbcore: fix unbalanced get/put cluster_id
  locking/lockdep: Hide unused 'class' variable
  locking/lockdep: Fix lock used or unused stats error
  mm/mmu_notifier: use hlist_add_head_rcu()
  9p: pass the correct prototype to read_cache_page
  mm/kmemleak.c: fix check for softirq context
  sh: prevent warnings when using iounmap
  powerpc/eeh: Handle hugepages in ioremap space
  mailbox: handle failed named mailbox channel request
  f2fs: avoid out-of-range memory access
  perf test mmap-thread-lookup: Initialize variable to suppress memory sanitizer warning
  kallsyms: exclude kasan local symbols on s390
  serial: sh-sci: Fix TX DMA buffer flushing and workqueue races
  powerpc/4xx/uic: clear pending interrupt after irq type/pol change
  um: Silence lockdep complaint about mmap_sem
  mfd: arizona: Fix undefined behavior
  mfd: core: Set fwnode for created devices
  recordmcount: Fix spurious mcount entries on powerpc
  iio: iio-utils: Fix possible incorrect mask calculation
  PCI: sysfs: Ignore lockdep for remove attribute
  powerpc/pci/of: Fix OF flags parsing for 64bit BARs
  usb: gadget: Zero ffs_io_data
  phy: renesas: rcar-gen2: Fix memory leak at error paths
  drm/virtio: Add memory barriers for capset cache.
  tty: serial: msm_serial: avoid system lockup condition
  tty/serial: digicolor: Fix digicolor-usart already registered warning
  memstick: Fix error cleanup path of memstick_init
  tty: serial: cpm_uart - fix init when SMC is relocated
  pinctrl: rockchip: fix leaked of_node references
  tty: max310x: Fix invalid baudrate divisors calculator
  usb: core: hub: Disable hub-initiated U1/U2
  drm/panel: simple: Fix panel_simple_dsi_probe
  nfsd: Fix overflow causing non-working mounts on 1 TB machines
  nfsd: fix performance-limiting session calculation
  nfsd: give out fewer session slots as limit approaches
  nfsd: increase DRC cache limit
  NFSv4: Fix open create exclusive when the server reboots
  elevator: fix truncation of icq_cache_name
  net: bridge: stp: don't cache eth dest pointer before skb pull
  net: bridge: mcast: fix stale ipv6 hdr pointer when handling v6 query
  net: bridge: mcast: fix stale nsrcs pointer in igmp3/mld2 report handling
  bonding: validate ip header before check IPPROTO_IGMP
  tcp: Reset bytes_acked and bytes_received when disconnecting
  netrom: hold sock when setting skb->destructor
  netrom: fix a memory leak in nr_rx_frame()
  sky2: Disable MSI on ASUS P6T
  nfc: fix potential illegal memory access
  net: neigh: fix multiple neigh timer scheduling
  net: bcmgenet: use promisc for unsupported filters
  ipv4: don't set IPv6 only flags to IPv4 addresses
  caif-hsi: fix possible deadlock in cfhsi_exit_module()
  bnx2x: Prevent load reordering in tx completion processing
  dm bufio: fix deadlock with loop device
  usb: Handle USB3 remote wakeup for LPM enabled devices correctly
  Bluetooth: Add SMP workaround Microsoft Surface Precision Mouse bug
  intel_th: msu: Fix single mode with disabled IOMMU
  eCryptfs: fix a couple type promotion bugs
  powerpc/watchpoint: Restore NV GPRs while returning from exception
  powerpc/32s: fix suspend/resume when IBATs 4-7 are used
  parisc: Fix kernel panic due invalid values in IAOQ0 or IAOQ1
  gpu: ipu-v3: ipu-ic: Fix saturation bit offset in TPMEM
  coda: pass the host file in vma->vm_file on mmap
  floppy: fix out-of-bounds read in copy_buffer
  floppy: fix invalid pointer dereference in drive_name
  floppy: fix out-of-bounds read in next_valid_format
  floppy: fix div-by-zero in setup_format_params
  take floppy compat ioctls to sodding floppy.c
  PCI: Do not poll for PME if the device is in D3cold
  9p/virtio: Add cleanup path in p9_virtio_init
  padata: use smp_mb in padata_reorder to avoid orphaned padata jobs
  drm/nouveau/i2c: Enable i2c pads & busses during preinit
  KVM: x86/vPMU: refine kvm_pmu err msg when event creation failed
  media: coda: Remove unbalanced and unneeded mutex unlock
  media: v4l2: Test type instead of cfg->type in v4l2_ctrl_new_custom()
  ALSA: seq: Break too long mutex context in the write loop
  lib/scatterlist: Fix mapping iterator when sg->offset is greater than PAGE_SIZE
  NFSv4: Handle the special Linux file open access mode
  tracing/snapshot: Resize spare buffer if size changed
  regulator: s2mps11: Fix buck7 and buck8 wrong voltages
  Input: gtco - bounds check collection indent level
  crypto: arm64/sha2-ce - correct digest for empty data in finup
  crypto: arm64/sha1-ce - correct digest for empty data in finup
  crypto: ghash - fix unaligned memory access in ghash_setkey()
  Bluetooth: validate BLE connection interval updates
  Bluetooth: Check state in l2cap_disconnect_rsp
  Bluetooth: 6lowpan: search for destination address in all peers
  Bluetooth: hci_bcsp: Fix memory leak in rx_skb
  bcache: check c->gc_thread by IS_ERR_OR_NULL in cache_set_flush()
  EDAC: Fix global-out-of-bounds write when setting edac_mc_poll_msec
  ixgbe: Check DDM existence in transceiver before access
  rslib: Fix handling of of caller provided syndrome
  rslib: Fix decoding of shortened codes
  ath10k: fix PCIE device wake up failed
  mt7601u: fix possible memory leak when the device is disconnected
  x86/build: Add 'set -e' to mkcapflags.sh to delete broken capflags.c
  mt7601u: do not schedule rx_tasklet when the device has been disconnected
  media: coda: increment sequence offset for the last returned frame
  media: coda: fix mpeg2 sequence number handling
  acpi/arm64: ignore 5.1 FADTs that are reported as 5.0
  timer_list: Guard procfs specific code
  ntp: Limit TAI-UTC offset
  media: i2c: fix warning same module names
  EDAC/sysfs: Fix memory leak when creating a csrow object
  vhost_net: disable zerocopy by default
  perf evsel: Make perf_evsel__name() accept a NULL argument
  xfrm: fix sa selector validation
  rcu: Force inlining of rcu_read_lock()
  bpf: silence warning messages in core
  regmap: fix bulk writes on paged registers
  gpio: omap: ensure irq is enabled before wakeup
  gpio: omap: fix lack of irqstatus_raw0 for OMAP4
  perf test 6: Fix missing kvm module load for s390
  s390/qdio: handle PENDING state for QEBSM devices
  net: axienet: Fix race condition causing TX hang
  net: fec: Do not use netdev messages too early
  cpupower : frequency-set -r option misses the last cpu in related cpu list
  media: wl128x: Fix some error handling in fm_v4l2_init_video_device()
  locking/lockdep: Fix merging of hlocks with non-zero references
  tua6100: Avoid build warnings.
  net: phy: Check against net_device being NULL
  media: staging: media: davinci_vpfe: - Fix for memory leak if decoder initialization fails.
  xfrm: Fix xfrm sel prefix length validation
  af_key: fix leaks in key_pol_get_resp and dump_sp.
  signal/pid_namespace: Fix reboot_pid_ns to use send_sig not force_sig
  net: stmmac: dwmac1000: Clear unused address entries
  media: vpss: fix a potential NULL pointer dereference
  media: marvell-ccic: fix DMA s/g desc number calculation
  crypto: talitos - fix skcipher failure due to wrong output IV
  media: dvb: usb: fix use after free in dvb_usb_device_exit
  batman-adv: fix for leaked TVLV handler.
  ath: DFS JP domain W56 fixed pulse type 3 RADAR detection
  ath6kl: add some bounds checking
  ath9k: Check for errors when reading SREV register
  ath10k: Do not send probe response template for mesh
  dmaengine: imx-sdma: fix use-after-free on probe error path
  MIPS: fix build on non-linux hosts
  MIPS: ath79: fix ar933x uart parity mode
  f2fs: use EINVAL for superblock with invalid magic
  f2fs: fix to read source block before invalidating it
  f2fs: remove redundant check from f2fs_setflags_common()
  f2fs: use generic checking and prep function for FS_IOC_SETFLAGS
  ANDROID: overlayfs: Fix a regression in commit b24be4acd
  ANDROID: xfrm: remove in_compat_syscall() checks
  ANDROID: enable CONFIG_RTC_DRV_TEST on cuttlefish
  BACKPORT: binder: Set end of SG buffer area properly.
  f2fs: improve print log in f2fs_sanity_check_ckpt()
  f2fs: avoid out-of-range memory access
  f2fs: fix to avoid long latency during umount
  f2fs: allow all the users to pin a file
  f2fs: support swap file w/ DIO
  f2fs: allocate blocks for pinned file
  f2fs: fix is_idle() check for discard type
  f2fs: add a rw_sem to cover quota flag changes
  f2fs: set SBI_NEED_FSCK for xattr corruption case
  f2fs: use generic EFSBADCRC/EFSCORRUPTED
  f2fs: Use DIV_ROUND_UP() instead of open-coding
  f2fs: print kernel message if filesystem is inconsistent
  f2fs: introduce f2fs_<level> macros to wrap f2fs_printk()
  f2fs: avoid get_valid_blocks() for cleanup
  f2fs: ioctl for removing a range from F2FS
  f2fs: only set project inherit bit for directory
  f2fs: separate f2fs i_flags from fs_flags and ext4 i_flags
  f2fs: Add option to limit required GC for checkpoint=disable
  f2fs: Fix accounting for unusable blocks
  f2fs: Fix root reserved on remount
  f2fs: Lower threshold for disable_cp_again
  f2fs: fix sparse warning
  f2fs: fix f2fs_show_options to show nodiscard mount option
  f2fs: add error prints for debugging mount failure
  f2fs: fix to do sanity check on segment bitmap of LFS curseg
  f2fs: add missing sysfs entries in documentation
  f2fs: fix to avoid deadloop if data_flush is on
  f2fs: always assume that the device is idle under gc_urgent
  f2fs: add bio cache for IPU
  f2fs: allow ssr block allocation during checkpoint=disable period
  f2fs: fix to check layout on last valid checkpoint park

Conflicts:
	drivers/net/wireless/ath/ath10k/hw.c
	fs/ecryptfs/crypto.c
	mm/vmstat.c

Change-Id: Ic268e845f4992a9dbdf5c985cfe9359a56a5c72e
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

1 files changed, 134 insertions, 36 deletions

diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index af4770f0672a..553a16e985aa 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -546,9 +546,13 @@ void f2fs_balance_fs_bg(struct f2fs_sb_info *sbi)
 		if (test_opt(sbi, DATA_FLUSH)) {
 			struct blk_plug plug;
 
+			mutex_lock(&sbi->flush_lock);
+
 			blk_start_plug(&plug);
 			f2fs_sync_dirty_inodes(sbi, FILE_INODE);
 			blk_finish_plug(&plug);
+
+			mutex_unlock(&sbi->flush_lock);
 		}
 		f2fs_sync_fs(sbi->sb, true);
 		stat_inc_bg_cp_count(sbi->stat_info);
@@ -869,11 +873,14 @@ void f2fs_dirty_to_prefree(struct f2fs_sb_info *sbi)
 	mutex_unlock(&dirty_i->seglist_lock);
 }
 
-int f2fs_disable_cp_again(struct f2fs_sb_info *sbi)
+block_t f2fs_get_unusable_blocks(struct f2fs_sb_info *sbi)
 {
+	int ovp_hole_segs =
+		(overprovision_segments(sbi) - reserved_segments(sbi));
+	block_t ovp_holes = ovp_hole_segs << sbi->log_blocks_per_seg;
 	struct dirty_seglist_info *dirty_i = DIRTY_I(sbi);
-	block_t ovp = overprovision_segments(sbi) << sbi->log_blocks_per_seg;
 	block_t holes[2] = {0, 0};	/* DATA and NODE */
+	block_t unusable;
 	struct seg_entry *se;
 	unsigned int segno;
 
@@ -887,10 +894,20 @@ int f2fs_disable_cp_again(struct f2fs_sb_info *sbi)
 	}
 	mutex_unlock(&dirty_i->seglist_lock);
 
-	if (holes[DATA] > ovp || holes[NODE] > ovp)
+	unusable = holes[DATA] > holes[NODE] ? holes[DATA] : holes[NODE];
+	if (unusable > ovp_holes)
+		return unusable - ovp_holes;
+	return 0;
+}
+
+int f2fs_disable_cp_again(struct f2fs_sb_info *sbi, block_t unusable)
+{
+	int ovp_hole_segs =
+		(overprovision_segments(sbi) - reserved_segments(sbi));
+	if (unusable > F2FS_OPTION(sbi).unusable_cap)
 		return -EAGAIN;
 	if (is_sbi_flag_set(sbi, SBI_CP_DISABLED_QUICK) &&
-		dirty_segments(sbi) > overprovision_segments(sbi))
+		dirty_segments(sbi) > ovp_hole_segs)
 		return -EAGAIN;
 	return 0;
 }
@@ -1556,6 +1573,10 @@ static int __issue_discard_cmd(struct f2fs_sb_info *sbi,
 		list_for_each_entry_safe(dc, tmp, pend_list, list) {
 			f2fs_bug_on(sbi, dc->state != D_PREP);
 
+			if (dpolicy->timeout != 0 &&
+				f2fs_time_over(sbi, dpolicy->timeout))
+				break;
+
 			if (dpolicy->io_aware && i < dpolicy->io_aware_gran &&
 						!is_idle(sbi, DISCARD_TIME)) {
 				io_interrupted = true;
@@ -1816,8 +1837,7 @@ static int __f2fs_issue_discard_zone(struct f2fs_sb_info *sbi,
 		devi = f2fs_target_device_index(sbi, blkstart);
 		if (blkstart < FDEV(devi).start_blk ||
 		    blkstart > FDEV(devi).end_blk) {
-			f2fs_msg(sbi->sb, KERN_ERR, "Invalid block %x",
-				 blkstart);
+			f2fs_err(sbi, "Invalid block %x", blkstart);
 			return -EIO;
 		}
 		blkstart -= FDEV(devi).start_blk;
@@ -1830,10 +1850,9 @@ static int __f2fs_issue_discard_zone(struct f2fs_sb_info *sbi,
 
 		if (sector & (bdev_zone_sectors(bdev) - 1) ||
 				nr_sects != bdev_zone_sectors(bdev)) {
-			f2fs_msg(sbi->sb, KERN_ERR,
-				"(%d) %s: Unaligned zone reset attempted (block %x + %x)",
-				devi, sbi->s_ndevs ? FDEV(devi).path: "",
-				blkstart, blklen);
+			f2fs_err(sbi, "(%d) %s: Unaligned zone reset attempted (block %x + %x)",
+				 devi, sbi->s_ndevs ? FDEV(devi).path : "",
+				 blkstart, blklen);
 			return -EIO;
 		}
 		trace_f2fs_issue_reset_zone(bdev, blkstart);
@@ -2197,15 +2216,14 @@ static void update_sit_entry(struct f2fs_sb_info *sbi, block_t blkaddr, int del)
 		mir_exist = f2fs_test_and_set_bit(offset,
 						se->cur_valid_map_mir);
 		if (unlikely(exist != mir_exist)) {
-			f2fs_msg(sbi->sb, KERN_ERR, "Inconsistent error "
-				"when setting bitmap, blk:%u, old bit:%d",
-				blkaddr, exist);
+			f2fs_err(sbi, "Inconsistent error when setting bitmap, blk:%u, old bit:%d",
+				 blkaddr, exist);
 			f2fs_bug_on(sbi, 1);
 		}
 #endif
 		if (unlikely(exist)) {
-			f2fs_msg(sbi->sb, KERN_ERR,
-				"Bitmap was wrongly set, blk:%u", blkaddr);
+			f2fs_err(sbi, "Bitmap was wrongly set, blk:%u",
+				 blkaddr);
 			f2fs_bug_on(sbi, 1);
 			se->valid_blocks--;
 			del = 0;
@@ -2226,15 +2244,14 @@ static void update_sit_entry(struct f2fs_sb_info *sbi, block_t blkaddr, int del)
 		mir_exist = f2fs_test_and_clear_bit(offset,
 						se->cur_valid_map_mir);
 		if (unlikely(exist != mir_exist)) {
-			f2fs_msg(sbi->sb, KERN_ERR, "Inconsistent error "
-				"when clearing bitmap, blk:%u, old bit:%d",
-				blkaddr, exist);
+			f2fs_err(sbi, "Inconsistent error when clearing bitmap, blk:%u, old bit:%d",
+				 blkaddr, exist);
 			f2fs_bug_on(sbi, 1);
 		}
 #endif
 		if (unlikely(!exist)) {
-			f2fs_msg(sbi->sb, KERN_ERR,
-				"Bitmap was wrongly cleared, blk:%u", blkaddr);
+			f2fs_err(sbi, "Bitmap was wrongly cleared, blk:%u",
+				 blkaddr);
 			f2fs_bug_on(sbi, 1);
 			se->valid_blocks++;
 			del = 0;
@@ -2716,6 +2733,39 @@ static void allocate_segment_by_default(struct f2fs_sb_info *sbi,
 	stat_inc_seg_type(sbi, curseg);
 }
 
+void allocate_segment_for_resize(struct f2fs_sb_info *sbi, int type,
+					unsigned int start, unsigned int end)
+{
+	struct curseg_info *curseg = CURSEG_I(sbi, type);
+	unsigned int segno;
+
+	down_read(&SM_I(sbi)->curseg_lock);
+	mutex_lock(&curseg->curseg_mutex);
+	down_write(&SIT_I(sbi)->sentry_lock);
+
+	segno = CURSEG_I(sbi, type)->segno;
+	if (segno < start || segno > end)
+		goto unlock;
+
+	if (f2fs_need_SSR(sbi) && get_ssr_segment(sbi, type))
+		change_curseg(sbi, type);
+	else
+		new_curseg(sbi, type, true);
+
+	stat_inc_seg_type(sbi, curseg);
+
+	locate_dirty_segment(sbi, segno);
+unlock:
+	up_write(&SIT_I(sbi)->sentry_lock);
+
+	if (segno != curseg->segno)
+		f2fs_notice(sbi, "For resize: curseg of type %d: %u ==> %u",
+			    type, segno, curseg->segno);
+
+	mutex_unlock(&curseg->curseg_mutex);
+	up_read(&SM_I(sbi)->curseg_lock);
+}
+
 void f2fs_allocate_new_segments(struct f2fs_sb_info *sbi)
 {
 	struct curseg_info *curseg;
@@ -2848,9 +2898,8 @@ int f2fs_trim_fs(struct f2fs_sb_info *sbi, struct fstrim_range *range)
 		goto out;
 
 	if (is_sbi_flag_set(sbi, SBI_NEED_FSCK)) {
-		f2fs_msg(sbi->sb, KERN_WARNING,
-			"Found FS corruption, run fsck to fix.");
-		return -EIO;
+		f2fs_warn(sbi, "Found FS corruption, run fsck to fix.");
+		return -EFSCORRUPTED;
 	}
 
 	/* start/end segment number in main_area */
@@ -3274,12 +3323,17 @@ int f2fs_inplace_write_data(struct f2fs_io_info *fio)
 
 	if (!IS_DATASEG(get_seg_entry(sbi, segno)->type)) {
 		set_sbi_flag(sbi, SBI_NEED_FSCK);
-		return -EFAULT;
+		f2fs_warn(sbi, "%s: incorrect segment(%u) type, run fsck to fix.",
+			  __func__, segno);
+		return -EFSCORRUPTED;
 	}
 
 	stat_inc_inplace_blocks(fio->sbi);
 
-	err = f2fs_submit_page_bio(fio);
+	if (fio->bio)
+		err = f2fs_merge_page_bio(fio);
+	else
+		err = f2fs_submit_page_bio(fio);
 	if (!err) {
 		update_device_state(fio);
 		f2fs_update_iostat(fio->sbi, fio->io_type, F2FS_BLKSIZE);
@@ -3470,6 +3524,11 @@ static int read_compacted_summaries(struct f2fs_sb_info *sbi)
 		seg_i = CURSEG_I(sbi, i);
 		segno = le32_to_cpu(ckpt->cur_data_segno[i]);
 		blk_off = le16_to_cpu(ckpt->cur_data_blkoff[i]);
+		if (blk_off > ENTRIES_IN_SUM) {
+			f2fs_bug_on(sbi, 1);
+			f2fs_put_page(page, 1);
+			return -EFAULT;
+		}
 		seg_i->next_segno = segno;
 		reset_curseg(sbi, i, 0);
 		seg_i->alloc_type = ckpt->alloc_type[i];
@@ -3607,8 +3666,11 @@ static int restore_curseg_summaries(struct f2fs_sb_info *sbi)
 
 	/* sanity check for summary blocks */
 	if (nats_in_cursum(nat_j) > NAT_JOURNAL_ENTRIES ||
-			sits_in_cursum(sit_j) > SIT_JOURNAL_ENTRIES)
+			sits_in_cursum(sit_j) > SIT_JOURNAL_ENTRIES) {
+		f2fs_err(sbi, "invalid journal entries nats %u sits %u\n",
+			 nats_in_cursum(nat_j), sits_in_cursum(sit_j));
 		return -EINVAL;
+	}
 
 	return 0;
 }
@@ -3839,7 +3901,7 @@ void f2fs_flush_sit_entries(struct f2fs_sb_info *sbi, struct cp_control *cpc)
 	struct f2fs_journal *journal = curseg->journal;
 	struct sit_entry_set *ses, *tmp;
 	struct list_head *head = &SM_I(sbi)->sit_entry_set;
-	bool to_journal = true;
+	bool to_journal = !is_sbi_flag_set(sbi, SBI_IS_RESIZEFS);
 	struct seg_entry *se;
 
 	down_write(&sit_i->sentry_lock);
@@ -3858,7 +3920,8 @@ void f2fs_flush_sit_entries(struct f2fs_sb_info *sbi, struct cp_control *cpc)
 	 * entries, remove all entries from journal and add and account
 	 * them in sit entry set.
 	 */
-	if (!__has_cursum_space(journal, sit_i->dirty_sentries, SIT_JOURNAL))
+	if (!__has_cursum_space(journal, sit_i->dirty_sentries, SIT_JOURNAL) ||
+								!to_journal)
 		remove_sits_in_journal(sbi);
 
 	/*
@@ -4173,11 +4236,10 @@ static int build_sit_entries(struct f2fs_sb_info *sbi)
 
 		start = le32_to_cpu(segno_in_journal(journal, i));
 		if (start >= MAIN_SEGS(sbi)) {
-			f2fs_msg(sbi->sb, KERN_ERR,
-					"Wrong journal entry on segno %u",
-					start);
+			f2fs_err(sbi, "Wrong journal entry on segno %u",
+				 start);
 			set_sbi_flag(sbi, SBI_NEED_FSCK);
-			err = -EINVAL;
+			err = -EFSCORRUPTED;
 			break;
 		}
 
@@ -4214,11 +4276,10 @@ static int build_sit_entries(struct f2fs_sb_info *sbi)
 	up_read(&curseg->journal_rwsem);
 
 	if (!err && total_node_blocks != valid_node_count(sbi)) {
-		f2fs_msg(sbi->sb, KERN_ERR,
-			"SIT is corrupted node# %u vs %u",
-			total_node_blocks, valid_node_count(sbi));
+		f2fs_err(sbi, "SIT is corrupted node# %u vs %u",
+			 total_node_blocks, valid_node_count(sbi));
 		set_sbi_flag(sbi, SBI_NEED_FSCK);
-		err = -EINVAL;
+		err = -EFSCORRUPTED;
 	}
 
 	return err;
@@ -4309,6 +4370,39 @@ static int build_dirty_segmap(struct f2fs_sb_info *sbi)
 	return init_victim_secmap(sbi);
 }
 
+static int sanity_check_curseg(struct f2fs_sb_info *sbi)
+{
+	int i;
+
+	/*
+	 * In LFS/SSR curseg, .next_blkoff should point to an unused blkaddr;
+	 * In LFS curseg, all blkaddr after .next_blkoff should be unused.
+	 */
+	for (i = 0; i < NO_CHECK_TYPE; i++) {
+		struct curseg_info *curseg = CURSEG_I(sbi, i);
+		struct seg_entry *se = get_seg_entry(sbi, curseg->segno);
+		unsigned int blkofs = curseg->next_blkoff;
+
+		if (f2fs_test_bit(blkofs, se->cur_valid_map))
+			goto out;
+
+		if (curseg->alloc_type == SSR)
+			continue;
+
+		for (blkofs += 1; blkofs < sbi->blocks_per_seg; blkofs++) {
+			if (!f2fs_test_bit(blkofs, se->cur_valid_map))
+				continue;
+out:
+			f2fs_err(sbi,
+				 "Current segment's next free block offset is inconsistent with bitmap, logtype:%u, segno:%u, type:%u, next_blkoff:%u, blkofs:%u",
+				 i, curseg->segno, curseg->alloc_type,
+				 curseg->next_blkoff, blkofs);
+			return -EFSCORRUPTED;
+		}
+	}
+	return 0;
+}
+
 /*
  * Update min, max modified time for cost-benefit GC algorithm
  */
@@ -4404,6 +4498,10 @@ int f2fs_build_segment_manager(struct f2fs_sb_info *sbi)
 	if (err)
 		return err;
 
+	err = sanity_check_curseg(sbi);
+	if (err)
+		return err;
+
 	init_min_max_mtime(sbi);
 	return 0;
 }