We drop the wb list_lock while writing back inodes, and we could manipulate the i_io_list while this is happening and drop our reference for the inode. Protect this by holding the i_obj_count reference during the writeback. Signed-off-by: Josef Bacik --- fs/fs-writeback.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c index cf7fab59e4d5..773b276328ec 100644 --- a/fs/fs-writeback.c +++ b/fs/fs-writeback.c @@ -1977,6 +1977,7 @@ static long writeback_sb_inodes(struct super_block *sb, trace_writeback_sb_inodes_requeue(inode); continue; } + iobj_get(inode); spin_unlock(&wb->list_lock); /* @@ -1987,6 +1988,7 @@ static long writeback_sb_inodes(struct super_block *sb, if (inode->i_state & I_SYNC) { /* Wait for I_SYNC. This function drops i_lock... */ inode_sleep_on_writeback(inode); + iobj_put(inode); /* Inode may be gone, start again */ spin_lock(&wb->list_lock); continue; @@ -2035,10 +2037,9 @@ static long writeback_sb_inodes(struct super_block *sb, inode_sync_complete(inode); spin_unlock(&inode->i_lock); - if (unlikely(tmp_wb != wb)) { - spin_unlock(&tmp_wb->list_lock); - spin_lock(&wb->list_lock); - } + spin_unlock(&tmp_wb->list_lock); + iobj_put(inode); + spin_lock(&wb->list_lock); /* * bail out to wb_writeback() often enough to check -- 2.49.0