- if (tag_get(slot, tag, j)) {
- BUG_ON(slot->slots[j] == NULL);
- results[nr_found++] = slot->slots[j];
+ if (!tag_get(slot, tag, j))
+ continue;
+ node = slot->slots[j];
+ /*
+ * Even though the tag was found set, we need to
+ * recheck that we have a non-NULL node, because
+ * if this lookup is lockless, it may have been
+ * subsequently deleted.
+ *
+ * Similar care must be taken in any place that
+ * lookup ->slots[x] without a lock (ie. can't
+ * rely on its value remaining the same).
+ */
+ if (node) {
+ node = rcu_dereference(node);
+ results[nr_found++] = node;