On Thu, May 28, 2020 at 09:04:02AM -0500, Eric W. Biederman wrote: [snip incorrect root cause analysis] > > But the insertion of children in insert_header also increases the count > so it does not look like that should be true. > Yes, I have missed the insert_header nreg increment, thus making my root cause analysis incorrect. IMHO, the bug does exist in the latest kernel. Could you please see: [PATCH] get_subdir: do not drop new subdir if returning it I've just sent to the fsdevel mailing list. In it I've added invariant: WARN_ON(dir->header.nreg < 2); at the end of __register_sysctl_table which the latest kernel fails to obey. The fix seems to belong to get_subdir function, therefore I've broke the thread and sent a new patch. Thanks, Boris.