Take the idr's lock while removing an element on the error path. Spotted by Nathan Lynch . --- 25-akpm/fs/super.c | 2 ++ 1 files changed, 2 insertions(+) diff -puN fs/super.c~set_anon_super-locking-fix fs/super.c --- 25/fs/super.c~set_anon_super-locking-fix 2004-04-14 20:19:10.502036288 -0700 +++ 25-akpm/fs/super.c 2004-04-14 20:19:23.186108016 -0700 @@ -563,7 +563,9 @@ int set_anon_super(struct super_block *s spin_unlock(&unnamed_dev_lock); if ((dev & MAX_ID_MASK) == (1 << MINORBITS)) { + spin_lock(&unnamed_dev_lock); idr_remove(&unnamed_dev_idr, dev); + spin_unlock(&unnamed_dev_lock); return -EMFILE; } s->s_dev = MKDEV(0, dev & MINORMASK); _