3 files changed, 14 insertions, 7 deletions

diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h
index 4c216b1bf20c..aeed0bac693b 100644
--- a/fs/ext4/ext4_jbd2.h
+++ b/fs/ext4/ext4_jbd2.h
@@ -194,16 +194,20 @@ static inline void ext4_journal_callback_add(handle_t *handle,
  * ext4_journal_callback_del: delete a registered callback
  * @handle: active journal transaction handle on which callback was registered
  * @jce: registered journal callback entry to unregister
+ * Return true if object was sucessfully removed
  */
-static inline void ext4_journal_callback_del(handle_t *handle,
+static inline bool ext4_journal_callback_try_del(handle_t *handle,
                                              struct ext4_journal_cb_entry *jce)
 {
+        bool deleted;
         struct ext4_sb_info *sbi =
                         EXT4_SB(handle->h_transaction->t_journal->j_private);
 
         spin_lock(&sbi->s_md_lock);
+        deleted = !list_empty(&jce->jce_list);
         list_del_init(&jce->jce_list);
         spin_unlock(&sbi->s_md_lock);
+        return deleted;
 }
 
 int
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 36c82a39d03f..580aada3d1bb 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -4423,11 +4423,11 @@ ext4_mb_free_metadata(handle_t *handle, struct ext4_buddy *e4b,
         node = rb_prev(new_node);
         if (node) {
                 entry = rb_entry(node, struct ext4_free_data, efd_node);
-                if (can_merge(entry, new_entry)) {
+                if (can_merge(entry, new_entry) &&
+                    ext4_journal_callback_try_del(handle, &entry->efd_jce)) {
                         new_entry->efd_start_cluster = entry->efd_start_cluster;
                         new_entry->efd_count += entry->efd_count;
                         rb_erase(node, &(db->bb_free_root));
-                        ext4_journal_callback_del(handle, &entry->efd_jce);
                         kmem_cache_free(ext4_free_data_cachep, entry);
                 }
         }
@@ -4435,10 +4435,10 @@ ext4_mb_free_metadata(handle_t *handle, struct ext4_buddy *e4b,
         node = rb_next(new_node);
         if (node) {
                 entry = rb_entry(node, struct ext4_free_data, efd_node);
-                if (can_merge(new_entry, entry)) {
+                if (can_merge(new_entry, entry) &&
+                    ext4_journal_callback_try_del(handle, &entry->efd_jce)) {
                         new_entry->efd_count += entry->efd_count;
                         rb_erase(node, &(db->bb_free_root));
-                        ext4_journal_callback_del(handle, &entry->efd_jce);
                         kmem_cache_free(ext4_free_data_cachep, entry);
                 }
         }
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 5d6d53578124..67ae9e332d42 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -353,10 +353,13 @@ static void ext4_journal_commit_callback(journal_t *journal, transaction_t *txn)
         struct super_block              *sb = journal->j_private;
         struct ext4_sb_info             *sbi = EXT4_SB(sb);
         int                             error = is_journal_aborted(journal);
-        struct ext4_journal_cb_entry    *jce, *tmp;
+        struct ext4_journal_cb_entry    *jce;
 
+        BUG_ON(txn->t_state == T_FINISHED);
         spin_lock(&sbi->s_md_lock);
-        list_for_each_entry_safe(jce, tmp, &txn->t_private_list, jce_list) {
+        while (!list_empty(&txn->t_private_list)) {
+                jce = list_entry(txn->t_private_list.next,
+                                 struct ext4_journal_cb_entry, jce_list);
                 list_del_init(&jce->jce_list);
                 spin_unlock(&sbi->s_md_lock);
                 jce->jce_func(sb, jce, error);