I have made an analysis of callers to d_delete() and found that all callers either hold parent inode lock or name is stable for another reason: https://lore.kernel.org/linux-fsdevel/20190104090357.GD22409@quack2.suse.cz/ But Jan preferred to keep take_dentry_name_snapshot() to be safe. I think the right thing to do is assert that parent inode is locked or no rename op in d_delete() and take the lock in ceph/ocfs2 to conform to the standard.