ext4_xattr_inode_lookup_create() will use s_root, so set it to NULL after do_one_tree(). Reported-and-tested-by: syzbot+fe42a669c87e4a980051@xxxxxxxxxxxxxxxxxxxxxxxxx Signed-off-by: Edward Adam Davis <eadavis@xxxxxx> --- fs/dcache.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/dcache.c b/fs/dcache.c index 407095188f83..e2f1a3f92ce9 100644 --- a/fs/dcache.c +++ b/fs/dcache.c @@ -1551,8 +1551,8 @@ void shrink_dcache_for_umount(struct super_block *sb) WARN(down_read_trylock(&sb->s_umount), "s_umount should've been locked"); dentry = sb->s_root; - sb->s_root = NULL; do_one_tree(dentry); + sb->s_root = NULL; while (!hlist_bl_empty(&sb->s_roots)) { dentry = dget(hlist_bl_entry(hlist_bl_first(&sb->s_roots), struct dentry, d_hash)); -- 2.43.0