Merge 4.4.71 into android-4.4

Changes in 4.4.71
	sparc: Fix -Wstringop-overflow warning
	dccp/tcp: do not inherit mc_list from parent
	ipv6/dccp: do not inherit ipv6_mc_list from parent
	s390/qeth: handle sysfs error during initialization
	s390/qeth: unbreak OSM and OSN support
	s390/qeth: avoid null pointer dereference on OSN
	tcp: avoid fragmenting peculiar skbs in SACK
	sctp: fix src address selection if using secondary addresses for ipv6
	sctp: do not inherit ipv6_{mc|ac|fl}_list from parent
	tcp: eliminate negative reordering in tcp_clean_rtx_queue
	net: Improve handling of failures on link and route dumps
	ipv6: Prevent overrun when parsing v6 header options
	ipv6: Check ip6_find_1stfragopt() return value properly.
	bridge: netlink: check vlan_default_pvid range
	qmi_wwan: add another Lenovo EM74xx device ID
	bridge: start hello_timer when enabling KERNEL_STP in br_stp_start
	ipv6: fix out of bound writes in __ip6_append_data()
	be2net: Fix offload features for Q-in-Q packets
	virtio-net: enable TSO/checksum offloads for Q-in-Q vlans
	tcp: avoid fastopen API to be used on AF_UNSPEC
	sctp: fix ICMP processing if skb is non-linear
	ipv4: add reference counting to metrics
	netem: fix skb_orphan_partial()
	net: phy: marvell: Limit errata to 88m1101
	vlan: Fix tcp checksum offloads in Q-in-Q vlans
	i2c: i2c-tiny-usb: fix buffer not being DMA capable
	mmc: sdhci-iproc: suppress spurious interrupt with Multiblock read
	HID: wacom: Have wacom_tpc_irq guard against possible NULL dereference
	scsi: mpt3sas: Force request partial completion alignment
	drm/radeon/ci: disable mclk switching for high refresh rates (v2)
	drm/radeon: Unbreak HPD handling for r600+
	pcmcia: remove left-over %Z format
	ALSA: hda - apply STAC_9200_DELL_M22 quirk for Dell Latitude D430
	slub/memcg: cure the brainless abuse of sysfs attributes
	drm/gma500/psb: Actually use VBT mode when it is found
	mm/migrate: fix refcount handling when !hugepage_migration_supported()
	mlock: fix mlock count can not decrease in race condition
	xfs: Fix missed holes in SEEK_HOLE implementation
	xfs: fix off-by-one on max nr_pages in xfs_find_get_desired_pgoff()
	xfs: fix over-copying of getbmap parameters from userspace
	xfs: handle array index overrun in xfs_dir2_leaf_readbuf()
	xfs: prevent multi-fsb dir readahead from reading random blocks
	xfs: fix up quotacheck buffer list error handling
	xfs: support ability to wait on new inodes
	xfs: update ag iterator to support wait on new inodes
	xfs: wait on new inodes during quotaoff dquot release
	xfs: fix indlen accounting error on partial delalloc conversion
	xfs: bad assertion for delalloc an extent that start at i_size
	xfs: fix unaligned access in xfs_btree_visit_blocks
	xfs: in _attrlist_by_handle, copy the cursor back to userspace
	xfs: only return -errno or success from attr ->put_listent
	Linux 4.4.71

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

1 files changed, 10 insertions, 21 deletions

diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index f5392ab2def1..ceea444dafb4 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -1208,7 +1208,7 @@ xfs_find_get_desired_pgoff(
 		unsigned	nr_pages;
 		unsigned int	i;
 
-		want = min_t(pgoff_t, end - index, PAGEVEC_SIZE);
+		want = min_t(pgoff_t, end - index, PAGEVEC_SIZE - 1) + 1;
 		nr_pages = pagevec_lookup(&pvec, inode->i_mapping, index,
 					  want);
 		/*
@@ -1235,17 +1235,6 @@ xfs_find_get_desired_pgoff(
 			break;
 		}
 
-		/*
-		 * At lease we found one page.  If this is the first time we
-		 * step into the loop, and if the first page index offset is
-		 * greater than the given search offset, a hole was found.
-		 */
-		if (type == HOLE_OFF && lastoff == startoff &&
-		    lastoff < page_offset(pvec.pages[0])) {
-			found = true;
-			break;
-		}
-
 		for (i = 0; i < nr_pages; i++) {
 			struct page	*page = pvec.pages[i];
 			loff_t		b_offset;
@@ -1257,18 +1246,18 @@ xfs_find_get_desired_pgoff(
 			 * file mapping. However, page->index will not change
 			 * because we have a reference on the page.
 			 *
-			 * Searching done if the page index is out of range.
-			 * If the current offset is not reaches the end of
-			 * the specified search range, there should be a hole
-			 * between them.
+			 * If current page offset is beyond where we've ended,
+			 * we've found a hole.
 			 */
-			if (page->index > end) {
-				if (type == HOLE_OFF && lastoff < endoff) {
-					*offset = lastoff;
-					found = true;
-				}
+			if (type == HOLE_OFF && lastoff < endoff &&
+			    lastoff < page_offset(pvec.pages[i])) {
+				found = true;
+				*offset = lastoff;
 				goto out;
 			}
+			/* Searching done if the page index is out of range. */
+			if (page->index > end)
+				goto out;
 
 			lock_page(page);
 			/*