On Sun, 21 Sep 2025, kernel test robot wrote:
> 
> Hello,
> 
> kernel test robot noticed "BUG:unable_to_handle_page_fault_for_address" on:
> 
> commit: 747e356babd8bdd569320c29916470345afd3cf7 ("[PATCH v3 5/6] VFS: rename kern_path_locked() and related functions.")
> url: https://github.com/intel-lab-lkp/linux/commits/NeilBrown/VFS-ovl-add-lookup_one_positive_killable/20250915-101929
> base: https://git.kernel.org/cgit/linux/kernel/git/vfs/vfs.git vfs.all
> patch link: https://lore.kernel.org/all/20250915021504.2632889-6-neilb@ownmail.net/
> patch subject: [PATCH v3 5/6] VFS: rename kern_path_locked() and related functions.

This incremental fix should be sufficient.

Thanks,
NeilBrown


diff --git a/fs/namei.c b/fs/namei.c
index 5ceb971632fe..92973a7a8091 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2772,7 +2772,7 @@ static struct dentry *__start_removing_path(int dfd, struct filename *name,
 	if (unlikely(type != LAST_NORM))
 		return ERR_PTR(-EINVAL);
 	/* don't fail immediately if it's r/o, at least try to report other errors */
-	error = mnt_want_write(path->mnt);
+	error = mnt_want_write(parent_path.mnt);
 	inode_lock_nested(parent_path.dentry->d_inode, I_MUTEX_PARENT);
 	d = lookup_one_qstr_excl(&last, parent_path.dentry, 0);
 	if (IS_ERR(d))
@@ -2789,7 +2789,7 @@ static struct dentry *__start_removing_path(int dfd, struct filename *name,
 unlock:
 	inode_unlock(parent_path.dentry->d_inode);
 	if (!error)
-		mnt_drop_write(path->mnt);
+		mnt_drop_write(parent_path.mnt);
 	return d;
 }