Merge tag 'for-4.18-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux

Pull btrfs fixes from David Sterba:
 "Two regression fixes and an incorrect error value propagation fix from
  'rename exchange'"

* tag 'for-4.18-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  Btrfs: fix return value on rename exchange failure
  btrfs: fix invalid-free in btrfs_extent_same
  Btrfs: fix physical offset reported by fiemap for inline extents

3 files changed, 12 insertions, 7 deletions

diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index cce6087d6880..e55843f536bc 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -4542,8 +4542,11 @@ int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
                         offset_in_extent = em_start - em->start;
                 em_end = extent_map_end(em);
                 em_len = em_end - em_start;
-                disko = em->block_start + offset_in_extent;
                 flags = 0;
+                if (em->block_start < EXTENT_MAP_LAST_BYTE)
+                        disko = em->block_start + offset_in_extent;
+                else
+                        disko = 0;
 
                 /*
                  * bump off for our next call to get_extent
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index e9482f0db9d0..be98dfc8d0f8 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -9443,6 +9443,7 @@ static int btrfs_rename_exchange(struct inode *old_dir,
         u64 new_idx = 0;
         u64 root_objectid;
         int ret;
+        int ret2;
         bool root_log_pinned = false;
         bool dest_log_pinned = false;
 
@@ -9639,7 +9640,8 @@ out_fail:
                         dest_log_pinned = false;
                 }
         }
-        ret = btrfs_end_transaction(trans);
+        ret2 = btrfs_end_transaction(trans);
+        ret = ret ? ret : ret2;
 out_notrans:
         if (new_ino == BTRFS_FIRST_FREE_OBJECTID)
                 up_read(&fs_info->subvol_sem);
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index c2837a32d689..43ecbe620dea 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -3577,7 +3577,7 @@ static int btrfs_extent_same(struct inode *src, u64 loff, u64 olen,
                 ret = btrfs_extent_same_range(src, loff, BTRFS_MAX_DEDUPE_LEN,
                                               dst, dst_loff, &cmp);
                 if (ret)
-                        goto out_unlock;
+                        goto out_free;
 
                 loff += BTRFS_MAX_DEDUPE_LEN;
                 dst_loff += BTRFS_MAX_DEDUPE_LEN;
@@ -3587,16 +3587,16 @@ static int btrfs_extent_same(struct inode *src, u64 loff, u64 olen,
                 ret = btrfs_extent_same_range(src, loff, tail_len, dst,
                                               dst_loff, &cmp);
 
+out_free:
+        kvfree(cmp.src_pages);
+        kvfree(cmp.dst_pages);
+
 out_unlock:
         if (same_inode)
                 inode_unlock(src);
         else
                 btrfs_double_inode_unlock(src, dst);
 
-out_free:
-        kvfree(cmp.src_pages);
-        kvfree(cmp.dst_pages);
-
         return ret;
 }