rmdir() succeeds on an empty subvolume

[Chris Webb <chris@arachsys.com>]

If I create an empty snapshot in a bcachefs filesystem, I can then remove
the snapshot directory causing the filesystem to drop into an emergency
read-only state:

  # bcachefs format -q /dev/zram1
  initializing new filesystem
  going read-write
  mounted with opts: (null)
  # mkdir -p /tmp/p
  # mount -t bcachefs /dev/zram1 /tmp/p
  # bcachefs subvolume create /tmp/p/s
  # rmdir /tmp/p/s
  # touch /tmp/p/test
  touch: cannot touch '/tmp/p/test': Read-only file system
  # dmesg -t | tail -n 6
  bcachefs (zram1): recovering from clean shutdown, journal seq 4
  bcachefs (zram1): going read-write
  bcachefs (zram1): mounted with opts: (null)
  bcachefs (zram1): missing subvolume 2
  bcachefs (zram1): emergency read only
  bcachefs (zram1): error deleting snapshot keys: -30

Since an unprivileged user can use bcachefs subvolume create in a directory
they own, they too can panic the filesystem by doing this.

Similarly, running rm -r on a directory containing a snapshot, the contents
of the snapshot are successfully cleared out before we run into trouble by
removing the subvolume inode.

I guess it should either succeed and delete the snapshot/subvolume, or it
should fail with EBUSY like rmdir() does on a mountpoint?

Best wishes,

Chris.