Merge tag 'for-6.8-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave...

Pull btrfs fixes from David Sterba:

 - two fixes preventing deletion and manual creation of subvolume qgroup

 - unify error code returned for unknown send flags

 - fix assertion during subvolume creation when anonymous device could
   be allocated by other thread (e.g. due to backref walk)

* tag 'for-6.8-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  btrfs: do not ASSERT() if the newly created subvolume already got read
  btrfs: forbid deleting live subvol qgroup
  btrfs: forbid creating subvol qgroups
  btrfs: send: return EOPNOTSUPP on unknown flags

diff --combined fs/btrfs/ioctl.c
index dfed9dd9c2d75b8205531b030c220b42820e77ce,fb2323b323bf900c8e86dfae8dae4733f7f97cb3..ac3316e0d11c3a42835dc8a2094b00a16019bd64
--- 1/fs/btrfs/ioctl.c
--- 2/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@@ -1293,15 -1293,6 +1293,15 @@@ static noinline int __btrfs_ioctl_snap_
                         * are limited to own subvolumes only
                         */
                        ret = -EPERM;
 +              } else if (btrfs_ino(BTRFS_I(src_inode)) != BTRFS_FIRST_FREE_OBJECTID) {
 +                      /*
 +                       * Snapshots must be made with the src_inode referring
 +                       * to the subvolume inode, otherwise the permission
 +                       * checking above is useless because we may have
 +                       * permission on a lower directory but not the subvol
 +                       * itself.
 +                       */
 +                      ret = -EINVAL;
                } else {
                        ret = btrfs_mksnapshot(&file->f_path, idmap,
                                               name, namelen,
@@@ -3815,6 -3806,11 +3815,11 @@@ static long btrfs_ioctl_qgroup_create(s
                goto out;
        }
  
+       if (sa->create && is_fstree(sa->qgroupid)) {
+               ret = -EINVAL;
+               goto out;
+       }
+ 
        trans = btrfs_join_transaction(root);
        if (IS_ERR(trans)) {
                ret = PTR_ERR(trans);
@@@ -4540,29 -4536,29 +4545,29 @@@ static int btrfs_ioctl_encoded_write(st
        if (ret < 0)
                goto out_acct;
  
 -      file_start_write(file);
 -
        if (iov_iter_count(&iter) == 0) {
                ret = 0;
 -              goto out_end_write;
 +              goto out_iov;
        }
        pos = args.offset;
        ret = rw_verify_area(WRITE, file, &pos, args.len);
        if (ret < 0)
 -              goto out_end_write;
 +              goto out_iov;
  
        init_sync_kiocb(&kiocb, file);
        ret = kiocb_set_rw_flags(&kiocb, 0);
        if (ret)
 -              goto out_end_write;
 +              goto out_iov;
        kiocb.ki_pos = pos;
  
 +      file_start_write(file);
 +
        ret = btrfs_do_write_iter(&kiocb, &iter, &args);
        if (ret > 0)
                fsnotify_modify(file);
  
 -out_end_write:
        file_end_write(file);
 +out_iov:
        kfree(iov);
  out_acct:
        if (ret > 0)