On Wed, Jun 22, 2022 at 04:51:46PM +0800, sunliming wrote: > The inode variable is used as a parameter by the step_into function, > but is not assigned a value in the sub-lookup_slow branch path. So > get the inode in the sub-lookup_slow branch path. Take a good look at handle_mounts() and the things it does when *not* in RCU mode (i.e. LOOKUP_RCU is not set). Specifically, *inode = d_backing_inode(path->dentry); *seqp = 0; /* out of RCU mode, so the value doesn't matter */ this part. IOW, the values passed to step_into() in inode/seq are overridden unless we stay in RCU mode. And if we'd been through lookup_slow(), we'd been out of RCU mode since before we called step_into().