Patch from Nikita Danilov sysfs is running dget() against dentries which can be reaped at any time. Negative dentries, apparently. This used to go BUG in dget() (with good reason), and will again go BUG with Maneesh's fix. Fix this race in sysfs by plucking the dentry off the parent's list under dcache_lock, and pinning it with dget_locked(). sysfs/inode.c | 11 ++++++++++- 1 files changed, 10 insertions(+), 1 deletion(-) diff -puN fs/sysfs/inode.c~sysfs-dget-fix fs/sysfs/inode.c --- 25/fs/sysfs/inode.c~sysfs-dget-fix 2003-02-20 15:55:08.000000000 -0800 +++ 25-akpm/fs/sysfs/inode.c 2003-02-20 15:55:08.000000000 -0800 @@ -808,7 +808,16 @@ void sysfs_remove_dir(struct kobject * k down(&dentry->d_inode->i_sem); list_for_each_safe(node,next,&dentry->d_subdirs) { - struct dentry * d = dget(list_entry(node,struct dentry,d_child)); + struct dentry * d; + + /** + * Use dget_locked(), because there may be unused (with + * ->d_count == 0) negative dentries lurking. + */ + spin_lock(&dcache_lock); + d = dget_locked(list_entry(node,struct dentry,d_child)); + spin_unlock(&dcache_lock); + /** * Make sure dentry is still there */ _