From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-fsdevel-owner@vger.kernel.org>
Received: from zeniv.linux.org.uk ([195.92.253.2]:59746 "EHLO
	ZenIV.linux.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1753142AbcG1S1E (ORCPT
	<rfc822;linux-fsdevel@vger.kernel.org>);
	Thu, 28 Jul 2016 14:27:04 -0400
Date: Thu, 28 Jul 2016 19:26:59 +0100
From: Al Viro <viro@ZenIV.linux.org.uk>
To: Oleg Drokin <oleg.drokin@intel.com>
Cc: linux-fsdevel@vger.kernel.org
Subject: insanity in ll_dirty_page_discard_warn()
Message-ID: <20160728182659.GV2356@ZenIV.linux.org.uk>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Sender: linux-fsdevel-owner@vger.kernel.org
List-ID: <linux-fsdevel.vger.kernel.org>

        /* this can be called inside spin lock so use GFP_ATOMIC. */
        buf = (char *)__get_free_page(GFP_ATOMIC);
        if (buf) {
                dentry = d_find_alias(page->mapping->host);
	...
	if (dentry)
		dput(dentry);

If it *can* be called under a spinlock, you have an obvious problem -
dput() can sleep.  d_find_alias() might've picked a hashed dentry with
zero refcount that got unhashed by the time of dput().  Or other references
used to exist, but got dropped by that point...