[PATCH 06/46] mm/filemap: read mapping->a_ops->free_folio under i_lock

[Pedro Falcato]

On Tue, Oct 27, 2026 at 12:17:26AM +0100, David Hildenbrand (Arm) wrote:
> From: Josef Bacik <josef at toxicpanda.com>
> 
> memory_failure() -> ... -> filemap_remove_folio() can read mapping->a_ops
> after the inode has been freed. Once the folio is deleted from the
> pagecache it no longer pins the mapping, so after i_lock is dropped
> e.g., a concurrent final iput() can evict and free the inode before
> filemap_free_folio() looks up mapping->a_ops->free_folio.

Ok, but after iput() then nothing also pins the filesystem, and thus the
module. So we can be calling into total garbage. So what gives?

You can't just take the pointer, you need to make sure the filesystem
is also still alive.

-- 
Pedro