Merge tag 'for-5.17-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave...

Pull btrfs fixes from David Sterba:
 "A few fixes and error handling improvements:

   - fix deadlock between quota disable and qgroup rescan worker

   - fix use-after-free after failure to create a snapshot

   - skip warning on unmount after log cleanup failure

   - don't start transaction for scrub if the fs is mounted read-only

   - tree checker verifies item sizes"

* tag 'for-5.17-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  btrfs: skip reserved bytes warning on unmount after log cleanup failure
  btrfs: fix use of uninitialized variable at rm device ioctl
  btrfs: fix use-after-free after failure to create a snapshot
  btrfs: tree-checker: check item_size for dev_item
  btrfs: tree-checker: check item_size for inode_item
  btrfs: fix deadlock between quota disable and qgroup rescan worker
  btrfs: don't start transaction for scrub if the fs is mounted read-only

diff --combined fs/btrfs/ioctl.c
index d8af662,9255227..33eda39
--- 1/fs/btrfs/ioctl.c
--- 2/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@@ -805,10 -805,7 +805,7 @@@ static int create_snapshot(struct btrfs
                goto fail;
        }
  
-       spin_lock(&fs_info->trans_lock);
-       list_add(&pending_snapshot->list,
-                &trans->transaction->pending_snapshots);
-       spin_unlock(&fs_info->trans_lock);
+       trans->pending_snapshot = pending_snapshot;
  
        ret = btrfs_commit_transaction(trans);
        if (ret)
@@@ -3152,8 -3149,10 +3149,8 @@@ static noinline int btrfs_ioctl_snap_de
        btrfs_inode_lock(inode, 0);
        err = btrfs_delete_subvolume(dir, dentry);
        btrfs_inode_unlock(inode, 0);
 -      if (!err) {
 -              fsnotify_rmdir(dir, dentry);
 -              d_delete(dentry);
 -      }
 +      if (!err)
 +              d_delete_notify(dir, dentry);
  
  out_dput:
        dput(dentry);
@@@ -3354,7 -3353,7 +3351,7 @@@ static long btrfs_ioctl_rm_dev(struct f
        struct block_device *bdev = NULL;
        fmode_t mode;
        int ret;
-       bool cancel;
+       bool cancel = false;
  
        if (!capable(CAP_SYS_ADMIN))
                return -EPERM;