I think I've found the cause of it, but having a sanity check is a good idea. I've simplified the patch and its description, though. This is what I have in my tree. - Ted commit 252194e48f00d146de303822bba8c3568ca127cd Author: Jiang Biao <jiang.biao2@xxxxxxxxxx> Date: Tue Jan 9 23:57:52 2018 -0500 mbcache: make sure c_entry_count is not decremented past zero Signed-off-by: Jiang Biao <jiang.biao2@xxxxxxxxxx> Signed-off-by: Theodore Ts'o <tytso@xxxxxxx> CC: Eric Biggers <ebiggers@xxxxxxxxxx> CC: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> CC: Jan Kara <jack@xxxxxxx> diff --git a/fs/mbcache.c b/fs/mbcache.c index 0851af5c1c3d..f2f15b747bed 100644 --- a/fs/mbcache.c +++ b/fs/mbcache.c @@ -239,7 +239,9 @@ void mb_cache_entry_delete(struct mb_cache *cache, u32 key, u64 value) spin_lock(&cache->c_list_lock); if (!list_empty(&entry->e_list)) { list_del_init(&entry->e_list); - cache->c_entry_count--; + if (!WARN_ONCE(cache->c_entry_count == 0, + "mbcache: attempt to decrement c_entry_count past zero")) + cache->c_entry_count--; atomic_dec(&entry->e_refcnt); } spin_unlock(&cache->c_list_lock);