ext4_xattr_inode_lookup_create() will use s_root, so set it to NULL
after do_one_tree().

Reported-and-tested-by: syzbot+fe42a669c87e4a980051@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
 fs/dcache.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/dcache.c b/fs/dcache.c
index 407095188f83..e2f1a3f92ce9 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1551,8 +1551,8 @@ void shrink_dcache_for_umount(struct super_block *sb)
 	WARN(down_read_trylock(&sb->s_umount), "s_umount should've been locked");
 
 	dentry = sb->s_root;
-	sb->s_root = NULL;
 	do_one_tree(dentry);
+	sb->s_root = NULL;
 
 	while (!hlist_bl_empty(&sb->s_roots)) {
 		dentry = dget(hlist_bl_entry(hlist_bl_first(&sb->s_roots), struct dentry, d_hash));
-- 
2.43.0

On Wed, May 29, 2024 at 09:15:02AM +0800, Edward Adam Davis wrote:
> ext4_xattr_inode_lookup_create() will use s_root, so set it to NULL
> after do_one_tree().

Why, in the name of everything unholy, would eviction of dentries need
to set any kind of xattrs?

On Wed, May 29, 2024 at 02:56:52AM +0100, Al Viro wrote:
> On Wed, May 29, 2024 at 09:15:02AM +0800, Edward Adam Davis wrote:
> > ext4_xattr_inode_lookup_create() will use s_root, so set it to NULL
> > after do_one_tree().
> 
> Why, in the name of everything unholy, would eviction of dentries need
> to set any kind of xattrs?

IOW, that might make the testcase STFU, but something odd is happening
there and I would really like to understand the details before we go
that way.