On Thu, 23 Nov 2023 12:25:48 +0100
Heiko Carstens [off-list ref] wrote:

So, if it helps (this still happens with Linus' master branch):

create_dir_dentry() is called with a "struct eventfs_inode *ei" (second
parameter), which points to a data structure where "is_freed" is 1. Then it
looks like create_dir() returned "-EEXIST". And looking at the code this
combination then must lead to d_invalidate() incorrectly being called with
"-EEXIST" as dentry pointer.

I haven't looked too much at the error codes, let me do that on Monday
(it's currently Turkey weekend here in the US).

But could you test this branch:

  git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git  trace/core

I have a bunch of fixes in that branch that may fix your issue. I just
finished testing it and plan on pushing it to Linus before the next rc
release.

Thanks!

-- Steve

Now, I have no idea how the code should work, but it is quite obvious that
something is broken :)

Here the dump of the struct eventfs_inode that was passed to
create_file_dentry() when the crash happened: