> +struct fs_struct *switch_fs_struct(struct fs_struct *new_fs)
> +{
> +	struct fs_struct *fs;
> +
> +	fs = current->fs;
> +	read_seqlock_excl(&fs->seq);
> +	current->fs = new_fs;
> +	if (--fs->users)
> +		new_fs = NULL;
> +	else
> +		new_fs = fs;
> +	read_sequnlock_excl(&fs->seq);
> +
> +	nullfs_userspace_init(fs);

This is called under task_lock() and nullfs_userspace_init() may sleep.
Oversight on my part.