Merge 4.7-rc4 into staging-next

We want the fixes in here, and we can resolve a merge issue in
drivers/iio/industrialio-trigger.c

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 96 insertions, 17 deletions

diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index da9e0036a864..2f631b58ae00 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -4241,6 +4241,7 @@ int btrfs_create_uuid_tree(struct btrfs_fs_info *fs_info)
         if (IS_ERR(uuid_root)) {
                 ret = PTR_ERR(uuid_root);
                 btrfs_abort_transaction(trans, tree_root, ret);
+                btrfs_end_transaction(trans, tree_root);
                 return ret;
         }
 
@@ -6258,27 +6259,23 @@ struct btrfs_device *btrfs_alloc_device(struct btrfs_fs_info *fs_info,
         return dev;
 }
 
-static int read_one_chunk(struct btrfs_root *root, struct btrfs_key *key,
-                          struct extent_buffer *leaf,
-                          struct btrfs_chunk *chunk)
+/* Return -EIO if any error, otherwise return 0. */
+static int btrfs_check_chunk_valid(struct btrfs_root *root,
+                                   struct extent_buffer *leaf,
+                                   struct btrfs_chunk *chunk, u64 logical)
 {
-        struct btrfs_mapping_tree *map_tree = &root->fs_info->mapping_tree;
-        struct map_lookup *map;
-        struct extent_map *em;
-        u64 logical;
         u64 length;
         u64 stripe_len;
-        u64 devid;
-        u8 uuid[BTRFS_UUID_SIZE];
-        int num_stripes;
-        int ret;
-        int i;
+        u16 num_stripes;
+        u16 sub_stripes;
+        u64 type;
 
-        logical = key->offset;
         length = btrfs_chunk_length(leaf, chunk);
         stripe_len = btrfs_chunk_stripe_len(leaf, chunk);
         num_stripes = btrfs_chunk_num_stripes(leaf, chunk);
-        /* Validation check */
+        sub_stripes = btrfs_chunk_sub_stripes(leaf, chunk);
+        type = btrfs_chunk_type(leaf, chunk);
+
         if (!num_stripes) {
                 btrfs_err(root->fs_info, "invalid chunk num_stripes: %u",
                           num_stripes);
@@ -6289,6 +6286,11 @@ static int read_one_chunk(struct btrfs_root *root, struct btrfs_key *key,
                           "invalid chunk logical %llu", logical);
                 return -EIO;
         }
+        if (btrfs_chunk_sector_size(leaf, chunk) != root->sectorsize) {
+                btrfs_err(root->fs_info, "invalid chunk sectorsize %u",
+                          btrfs_chunk_sector_size(leaf, chunk));
+                return -EIO;
+        }
         if (!length || !IS_ALIGNED(length, root->sectorsize)) {
                 btrfs_err(root->fs_info,
                         "invalid chunk length %llu", length);
@@ -6300,13 +6302,54 @@ static int read_one_chunk(struct btrfs_root *root, struct btrfs_key *key,
                 return -EIO;
         }
         if (~(BTRFS_BLOCK_GROUP_TYPE_MASK | BTRFS_BLOCK_GROUP_PROFILE_MASK) &
-            btrfs_chunk_type(leaf, chunk)) {
+            type) {
                 btrfs_err(root->fs_info, "unrecognized chunk type: %llu",
                           ~(BTRFS_BLOCK_GROUP_TYPE_MASK |
                             BTRFS_BLOCK_GROUP_PROFILE_MASK) &
                           btrfs_chunk_type(leaf, chunk));
                 return -EIO;
         }
+        if ((type & BTRFS_BLOCK_GROUP_RAID10 && sub_stripes != 2) ||
+            (type & BTRFS_BLOCK_GROUP_RAID1 && num_stripes < 1) ||
+            (type & BTRFS_BLOCK_GROUP_RAID5 && num_stripes < 2) ||
+            (type & BTRFS_BLOCK_GROUP_RAID6 && num_stripes < 3) ||
+            (type & BTRFS_BLOCK_GROUP_DUP && num_stripes > 2) ||
+            ((type & BTRFS_BLOCK_GROUP_PROFILE_MASK) == 0 &&
+             num_stripes != 1)) {
+                btrfs_err(root->fs_info,
+                        "invalid num_stripes:sub_stripes %u:%u for profile %llu",
+                        num_stripes, sub_stripes,
+                        type & BTRFS_BLOCK_GROUP_PROFILE_MASK);
+                return -EIO;
+        }
+
+        return 0;
+}
+
+static int read_one_chunk(struct btrfs_root *root, struct btrfs_key *key,
+                          struct extent_buffer *leaf,
+                          struct btrfs_chunk *chunk)
+{
+        struct btrfs_mapping_tree *map_tree = &root->fs_info->mapping_tree;
+        struct map_lookup *map;
+        struct extent_map *em;
+        u64 logical;
+        u64 length;
+        u64 stripe_len;
+        u64 devid;
+        u8 uuid[BTRFS_UUID_SIZE];
+        int num_stripes;
+        int ret;
+        int i;
+
+        logical = key->offset;
+        length = btrfs_chunk_length(leaf, chunk);
+        stripe_len = btrfs_chunk_stripe_len(leaf, chunk);
+        num_stripes = btrfs_chunk_num_stripes(leaf, chunk);
+
+        ret = btrfs_check_chunk_valid(root, leaf, chunk, logical);
+        if (ret)
+                return ret;
 
         read_lock(&map_tree->map_tree.lock);
         em = lookup_extent_mapping(&map_tree->map_tree, logical, 1);
@@ -6554,6 +6597,7 @@ int btrfs_read_sys_array(struct btrfs_root *root)
         u32 array_size;
         u32 len = 0;
         u32 cur_offset;
+        u64 type;
         struct btrfs_key key;
 
         ASSERT(BTRFS_SUPER_INFO_SIZE <= root->nodesize);
@@ -6563,8 +6607,8 @@ int btrfs_read_sys_array(struct btrfs_root *root)
          * overallocate but we can keep it as-is, only the first page is used.
          */
         sb = btrfs_find_create_tree_block(root, BTRFS_SUPER_INFO_OFFSET);
-        if (!sb)
-                return -ENOMEM;
+        if (IS_ERR(sb))
+                return PTR_ERR(sb);
         set_extent_buffer_uptodate(sb);
         btrfs_set_buffer_lockdep_class(root->root_key.objectid, sb, 0);
         /*
@@ -6620,6 +6664,15 @@ int btrfs_read_sys_array(struct btrfs_root *root)
                                 break;
                         }
 
+                        type = btrfs_chunk_type(sb, chunk);
+                        if ((type & BTRFS_BLOCK_GROUP_SYSTEM) == 0) {
+                                btrfs_err(root->fs_info,
+                            "invalid chunk type %llu in sys_array at offset %u",
+                                        type, cur_offset);
+                                ret = -EIO;
+                                break;
+                        }
+
                         len = btrfs_chunk_item_size(num_stripes);
                         if (cur_offset + len > array_size)
                                 goto out_short_read;
@@ -6638,12 +6691,14 @@ int btrfs_read_sys_array(struct btrfs_root *root)
                 sb_array_offset += len;
                 cur_offset += len;
         }
+        clear_extent_buffer_uptodate(sb);
         free_extent_buffer_stale(sb);
         return ret;
 
 out_short_read:
         printk(KERN_ERR "BTRFS: sys_array too short to read %u bytes at offset %u\n",
                         len, cur_offset);
+        clear_extent_buffer_uptodate(sb);
         free_extent_buffer_stale(sb);
         return -EIO;
 }
@@ -6656,6 +6711,7 @@ int btrfs_read_chunk_tree(struct btrfs_root *root)
         struct btrfs_key found_key;
         int ret;
         int slot;
+        u64 total_dev = 0;
 
         root = root->fs_info->chunk_root;
 
@@ -6697,6 +6753,7 @@ int btrfs_read_chunk_tree(struct btrfs_root *root)
                         ret = read_one_dev(root, leaf, dev_item);
                         if (ret)
                                 goto error;
+                        total_dev++;
                 } else if (found_key.type == BTRFS_CHUNK_ITEM_KEY) {
                         struct btrfs_chunk *chunk;
                         chunk = btrfs_item_ptr(leaf, slot, struct btrfs_chunk);
@@ -6706,6 +6763,28 @@ int btrfs_read_chunk_tree(struct btrfs_root *root)
                 }
                 path->slots[0]++;
         }
+
+        /*
+         * After loading chunk tree, we've got all device information,
+         * do another round of validation checks.
+         */
+        if (total_dev != root->fs_info->fs_devices->total_devices) {
+                btrfs_err(root->fs_info,
+           "super_num_devices %llu mismatch with num_devices %llu found here",
+                          btrfs_super_num_devices(root->fs_info->super_copy),
+                          total_dev);
+                ret = -EINVAL;
+                goto error;
+        }
+        if (btrfs_super_total_bytes(root->fs_info->super_copy) <
+            root->fs_info->fs_devices->total_rw_bytes) {
+                btrfs_err(root->fs_info,
+        "super_total_bytes %llu mismatch with fs_devices total_rw_bytes %llu",
+                          btrfs_super_total_bytes(root->fs_info->super_copy),
+                          root->fs_info->fs_devices->total_rw_bytes);
+                ret = -EINVAL;
+                goto error;
+        }
         ret = 0;
 error:
         unlock_chunks(root);