Merge tag 'xfs-4.20-fixes-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux

Pull xfs fixes from Darrick Wong:
 "Here are hopefully the last set of fixes for 4.20.

  There's a fix for a longstanding statfs reporting problem with project
  quotas, a correction for page cache invalidation behaviors when
  fallocating near EOF, and a fix for a broken metadata verifier return
  code.

  Finally, the most important fix is to the pipe splicing code (aka the
  generic copy_file_range fallback) to avoid pointless short directio
  reads by only asking the filesystem for as much data as there are
  available pages in the pipe buffer. Our previous fix (simulated short
  directio reads because the number of pages didn't match the length of
  the read requested) caused subtle problems on overlayfs, so that part
  is reverted.

  Anyhow, this series passes fstests -g all on xfs and overlay+xfs, and
  has passed 17 billion fsx operations problem-free since I started
  testing

  Summary:

   - Fix broken project quota inode counts

   - Fix incorrect PAGE_MASK/PAGE_SIZE usage

   - Fix incorrect return value in btree verifier

   - Fix WARN_ON remap flags false positive

   - Fix splice read overflows"

* tag 'xfs-4.20-fixes-3' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
  iomap: partially revert 4721a601099 (simulated directio short read on EFAULT)
  splice: don't read more than available pipe space
  vfs: allow some remap flags to be passed to vfs_clone_file_range
  xfs: fix inverted return from xfs_btree_sblock_verify_crc
  xfs: fix PAGE_MASK usage in xfs_free_file_space
  fs/xfs: fix f_ffree value for statfs when project quota is set

6 files changed, 11 insertions, 15 deletions

diff --git a/fs/iomap.c b/fs/iomap.c
index 3ffb776fbebe..d6bc98ae8d35 100644
--- a/fs/iomap.c
+++ b/fs/iomap.c
@@ -1877,15 +1877,6 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter,
                                 dio->wait_for_completion = true;
                                 ret = 0;
                         }
-
-                        /*
-                         * Splicing to pipes can fail on a full pipe. We have to
-                         * swallow this to make it look like a short IO
-                         * otherwise the higher splice layers will completely
-                         * mishandle the error and stop moving data.
-                         */
-                        if (ret == -EFAULT)
-                                ret = 0;
                         break;
                 }
                 pos += ret;
diff --git a/fs/read_write.c b/fs/read_write.c
index 4dae0399c75a..58f30537c47a 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -1956,7 +1956,7 @@ loff_t do_clone_file_range(struct file *file_in, loff_t pos_in,
         struct inode *inode_out = file_inode(file_out);
         loff_t ret;
 
-        WARN_ON_ONCE(remap_flags);
+        WARN_ON_ONCE(remap_flags & REMAP_FILE_DEDUP);
 
         if (S_ISDIR(inode_in->i_mode) || S_ISDIR(inode_out->i_mode))
                 return -EISDIR;
diff --git a/fs/splice.c b/fs/splice.c
index 3553f1956508..de2ede048473 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -945,11 +945,16 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
         sd->flags &= ~SPLICE_F_NONBLOCK;
         more = sd->flags & SPLICE_F_MORE;
 
+        WARN_ON_ONCE(pipe->nrbufs != 0);
+
         while (len) {
                 size_t read_len;
                 loff_t pos = sd->pos, prev_pos = pos;
 
-                ret = do_splice_to(in, &pos, pipe, len, flags);
+                /* Don't try to read more the pipe has space for. */
+                read_len = min_t(size_t, len,
+                                 (pipe->buffers - pipe->nrbufs) << PAGE_SHIFT);
+                ret = do_splice_to(in, &pos, pipe, read_len, flags);
                 if (unlikely(ret <= 0))
                         goto out_release;
 
diff --git a/fs/xfs/libxfs/xfs_btree.c b/fs/xfs/libxfs/xfs_btree.c
index 34c6d7bd4d18..bbdae2b4559f 100644
--- a/fs/xfs/libxfs/xfs_btree.c
+++ b/fs/xfs/libxfs/xfs_btree.c
@@ -330,7 +330,7 @@ xfs_btree_sblock_verify_crc(
 
         if (xfs_sb_version_hascrc(&mp->m_sb)) {
                 if (!xfs_log_check_lsn(mp, be64_to_cpu(block->bb_u.s.bb_lsn)))
-                        return __this_address;
+                        return false;
                 return xfs_buf_verify_cksum(bp, XFS_BTREE_SBLOCK_CRC_OFF);
         }
 
diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index 404e581f1ea1..1ee8c5539fa4 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -1126,9 +1126,9 @@ xfs_free_file_space(
          * page could be mmap'd and iomap_zero_range doesn't do that for us.
          * Writeback of the eof page will do this, albeit clumsily.
          */
-        if (offset + len >= XFS_ISIZE(ip) && ((offset + len) & PAGE_MASK)) {
+        if (offset + len >= XFS_ISIZE(ip) && offset_in_page(offset + len) > 0) {
                 error = filemap_write_and_wait_range(VFS_I(ip)->i_mapping,
-                                (offset + len) & ~PAGE_MASK, LLONG_MAX);
+                                round_down(offset + len, PAGE_SIZE), LLONG_MAX);
         }
 
         return error;
diff --git a/fs/xfs/xfs_qm_bhv.c b/fs/xfs/xfs_qm_bhv.c
index 73a1d77ec187..3091e4bc04ef 100644
--- a/fs/xfs/xfs_qm_bhv.c
+++ b/fs/xfs/xfs_qm_bhv.c
@@ -40,7 +40,7 @@ xfs_fill_statvfs_from_dquot(
                 statp->f_files = limit;
                 statp->f_ffree =
                         (statp->f_files > dqp->q_res_icount) ?
-                         (statp->f_ffree - dqp->q_res_icount) : 0;
+                         (statp->f_files - dqp->q_res_icount) : 0;
         }
 }