On Tue, Jun 21, 2011 at 03:40:56PM +1000, Dave Chinner wrote:

Modification of inode->i_state is not safe outside the
inode->i_lock.

We never actually set the new bit in i_state, we just use it as a key
for the hashed lookups.  Or rather we try to, as I misunderstood how
wait_on_bit works, so currently we busywait for i_dio_count to reach
zero.  I'll respin a version that actually works as expected.