Merge tag 'for-4.15-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave...

Pull btrfs fixes from David Sterba:
 "This contains a few fixes (error handling, quota leak, FUA vs
  nobarrier mount option).

  There's one one worth mentioning separately - an off-by-one fix that
  leads to overwriting first byte of an adjacent page with 0, out of
  bounds of the memory allocated by an ioctl. This is under a privileged
  part of the ioctl, can be triggerd in some subvolume layouts"

* tag 'for-4.15-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  btrfs: Fix possible off-by-one in btrfs_search_path_in_tree
  Btrfs: disable FUA if mounted with nobarrier
  btrfs: fix missing error return in btrfs_drop_snapshot
  btrfs: handle errors while updating refcounts in update_ref_for_cow
  btrfs: Fix quota reservation leak on preallocated files

diff --combined fs/btrfs/extent-tree.c
index 4497f937e8fb7ce608f8ef7cc8db1c7a51bcd2a3,16e46ee3cd16a923d53338675cae7c4d93d5d7c9..2f4328511ac84e11b8148952b09b25f3b4bb4e9d
--- 1/fs/btrfs/extent-tree.c
--- 2/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@@ -3992,9 -3992,16 +3992,9 @@@ void btrfs_dec_nocow_writers(struct btr
        btrfs_put_block_group(bg);
  }
  
 -static int btrfs_wait_nocow_writers_atomic_t(atomic_t *a)
 -{
 -      schedule();
 -      return 0;
 -}
 -
  void btrfs_wait_nocow_writers(struct btrfs_block_group_cache *bg)
  {
 -      wait_on_atomic_t(&bg->nocow_writers,
 -                       btrfs_wait_nocow_writers_atomic_t,
 +      wait_on_atomic_t(&bg->nocow_writers, atomic_t_wait,
                         TASK_UNINTERRUPTIBLE);
  }
  
@@@ -6523,6 -6530,12 +6523,6 @@@ void btrfs_dec_block_group_reservations
        btrfs_put_block_group(bg);
  }
  
 -static int btrfs_wait_bg_reservations_atomic_t(atomic_t *a)
 -{
 -      schedule();
 -      return 0;
 -}
 -
  void btrfs_wait_block_group_reservations(struct btrfs_block_group_cache *bg)
  {
        struct btrfs_space_info *space_info = bg->space_info;
@@@ -6545,7 -6558,8 +6545,7 @@@
        down_write(&space_info->groups_sem);
        up_write(&space_info->groups_sem);
  
 -      wait_on_atomic_t(&bg->reservations,
 -                       btrfs_wait_bg_reservations_atomic_t,
 +      wait_on_atomic_t(&bg->reservations, atomic_t_wait,
                         TASK_UNINTERRUPTIBLE);
  }
  
@@@ -9206,6 -9220,7 +9206,7 @@@ int btrfs_drop_snapshot(struct btrfs_ro
        ret = btrfs_del_root(trans, fs_info, &root->root_key);
        if (ret) {
                btrfs_abort_transaction(trans, ret);
+               err = ret;
                goto out_end_trans;
        }
  
@@@ -11045,6 -11060,12 +11046,6 @@@ int btrfs_start_write_no_snapshotting(s
        return 1;
  }
  
 -static int wait_snapshotting_atomic_t(atomic_t *a)
 -{
 -      schedule();
 -      return 0;
 -}
 -
  void btrfs_wait_for_snapshot_creation(struct btrfs_root *root)
  {
        while (true) {
@@@ -11053,7 -11074,8 +11054,7 @@@
                ret = btrfs_start_write_no_snapshotting(root);
                if (ret)
                        break;
 -              wait_on_atomic_t(&root->will_be_snapshotted,
 -                               wait_snapshotting_atomic_t,
 +              wait_on_atomic_t(&root->will_be_snapshotted, atomic_t_wait,
                                 TASK_UNINTERRUPTIBLE);
        }
  }

diff --combined fs/btrfs/ioctl.c
index d748ad1c3620a7e99ff9706902846362a165a05a,1a508fff7afe9cfb23d9a28b6cedbafaa1537e67..2ef8acaac68846ea1d29452a0b0f1d95d85cc6e5
--- 1/fs/btrfs/ioctl.c
--- 2/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@@ -1172,7 -1172,7 +1172,7 @@@ again
        if (!i_done || ret)
                goto out;
  
 -      if (!(inode->i_sb->s_flags & MS_ACTIVE))
 +      if (!(inode->i_sb->s_flags & SB_ACTIVE))
                goto out;
  
        /*
@@@ -1333,7 -1333,7 +1333,7 @@@ int btrfs_defrag_file(struct inode *ino
                 * make sure we stop running if someone unmounts
                 * the FS
                 */
 -              if (!(inode->i_sb->s_flags & MS_ACTIVE))
 +              if (!(inode->i_sb->s_flags & SB_ACTIVE))
                        break;
  
                if (btrfs_defrag_cancelled(fs_info)) {
@@@ -2206,7 -2206,7 +2206,7 @@@ static noinline int btrfs_search_path_i
        if (!path)
                return -ENOMEM;
  
-       ptr = &name[BTRFS_INO_LOOKUP_PATH_MAX];
+       ptr = &name[BTRFS_INO_LOOKUP_PATH_MAX - 1];
  
        key.objectid = tree_id;
        key.type = BTRFS_ROOT_ITEM_KEY;