I'd agree, except for the fact that the inode code doesn't use the error
pointers (only used by dentries "struct dentry" and the "char *" in
"getname()"). And looking at the patch, it's an inode pointer that is
corrupted, not a dentry pointer.
(But yes, 0xffffffff would be "EPERM" as a error pointer, which is why I
also first thought it was a error pointer. But it's definitely the
"inode->i_op" dereference that faults here..).
Linus