On Mon, May 14, 2018 at 10:11:54AM -0700, Eric Biggers wrote: > > I'm not following, since generic_shutdown_super() only calls ->put_super() if > > ->s_root is set, which only happens at the end of shmem_fill_super(). Isn't the > > real problem that s_shrink is registered too early, causing super_cache_count() > > and shmem_unused_huge_count() to potentially run before shmem_fill_super() has > > completed? Or alternatively, the problem is that super_cache_count() doesn't > > check for SB_ACTIVE. > > > > Coincidentally, this is already going to be fixed by commit 79f546a696bff259 > ("fs: don't scan the inode cache before SB_BORN is set") in vfs/for-linus. Exactly. While we are at it, we could add static void shmem_kill_super(struct super_block *sb) { struct shmem_sb_info *sbinfo = SHMEM_SB(sb); kill_litter_super(sb); if (sbinfo) { percpu_counter_destroy(&sbinfo->used_blocks); mpol_put(sbinfo->mpol); kfree(sbinfo); } } use that for ->kill_sb() and to hell with shmem_put_super() *and* its call in cleanup path of shmem_fill_super() - these err = -E...; goto failed; in there become simply return -E...;