diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
index a5c7c499cc29..7556d87934b7 100644
--- a/fs/ubifs/journal.c
+++ b/fs/ubifs/journal.c
@@ -971,7 +971,8 @@ int ubifs_jnl_write_data(struct ubifs_info *c, const struct inode *inode,
  */
 int ubifs_jnl_write_inode(struct ubifs_info *c, const struct inode *inode)
 {
-	int err, lnum, offs;
+	int err, lnum, offs, i = 0;
+	struct inode **xinos = NULL;
 	struct ubifs_ino_node *ino, *ino_start;
 	struct ubifs_inode *ui = ubifs_inode(inode);
 	int sync = 0, write_len = 0, ilen = UBIFS_INO_NODE_SZ;
@@ -982,44 +983,24 @@ int ubifs_jnl_write_inode(struct ubifs_info *c, const struct inode *inode)
 	dbg_jnl("ino %lu, nlink %u", inode->i_ino, inode->i_nlink);
 
 	if (kill_xattrs) {
+		union ubifs_key key;
+		struct fscrypt_name nm = {0};
+		struct ubifs_dent_node *xent, *pxent = NULL;
+		struct super_block *sb = c->vfs_sb;
+
 		if (ui->xattr_cnt > ubifs_xattr_max_cnt(c)) {
 			ubifs_err(c, "Cannot delete inode, it has too much xattrs!");
 			ubifs_ro_mode(c, err);
 			return -EPERM;
 		}
-	}
-
-	/*
-	 * If the inode is being deleted, do not write the attached data. No
-	 * need to synchronize the write-buffer either.
-	 */
-	if (!last_reference) {
-		ilen += ui->data_len;
-		sync = IS_SYNC(inode);
-	} else if (kill_xattrs) {
-		write_len += UBIFS_INO_NODE_SZ * ui->xattr_cnt;
-	}
-
-	if (ubifs_authenticated(c))
-		write_len += ALIGN(ilen, 8) + ubifs_auth_node_sz(c);
-	else
-		write_len += ilen;
 
-	ino_start = ino = kmalloc(write_len, GFP_NOFS);
-	if (!ino)
-		return -ENOMEM;
-
-	/* Make reservation before allocating sequence numbers */
-	err = make_reservation(c, BASEHD, write_len);
-	if (err)
-		goto out_free;
-
-	if (kill_xattrs) {
-		union ubifs_key key;
-		struct fscrypt_name nm = {0};
-		struct inode *xino;
-		struct ubifs_dent_node *xent, *pxent = NULL;
+		xinos = kmalloc(sizeof(*xinos) * ui->xattr_cnt, GFP_NOFS);
+		if (!xinos) {
+			ubifs_err(c, "Cannot allocate memory for xattr inodes");
+			return -ENOMEM;
+		}
 
+		i = 0;
 		lowest_xent_key(c, &key, inode->i_ino);
 		while (1) {
 			xent = ubifs_tnc_next_ent(c, &key, &nm);
@@ -1029,34 +1010,71 @@ int ubifs_jnl_write_inode(struct ubifs_info *c, const struct inode *inode)
 					break;
 
 				kfree(pxent);
-				goto out_release;
+				goto out_iput;
 			}
 
 			fname_name(&nm) = xent->name;
 			fname_len(&nm) = le16_to_cpu(xent->nlen);
 
-			xino = ubifs_iget(c->vfs_sb, le64_to_cpu(xent->inum));
-			if (IS_ERR(xino)) {
-				err = PTR_ERR(xino);
+			xinos[i] = ubifs_iget(sb, le64_to_cpu(xent->inum));
+			if (IS_ERR(xinos[i])) {
+				err = PTR_ERR(xinos[i]);
 				ubifs_err(c, "dead directory entry '%s', error %d",
 					  xent->name, err);
 				ubifs_ro_mode(c, err);
 				kfree(pxent);
 				kfree(xent);
-				goto out_release;
+				goto out_iput;
 			}
-			ubifs_assert(c, ubifs_inode(xino)->xattr);
-
-			clear_nlink(xino);
-			pack_inode(c, ino, xino, 0);
-			ino = (void *)ino + UBIFS_INO_NODE_SZ;
-			iput(xino);
+			ubifs_assert(c, ubifs_inode(xinos[i])->xattr);
+			ubifs_assert(c, i < ui->xattr_cnt);
 
 			kfree(pxent);
 			pxent = xent;
 			key_read(c, &xent->key, &key);
+			i++;
 		}
 		kfree(pxent);
+		ubifs_assert(c, i == ui->xattr_cnt);
+	}
+
+	/*
+	 * If the inode is being deleted, do not write the attached data. No
+	 * need to synchronize the write-buffer either.
+	 */
+	if (!last_reference) {
+		ilen += ui->data_len;
+		sync = IS_SYNC(inode);
+	} else if (kill_xattrs) {
+		write_len += UBIFS_INO_NODE_SZ * ui->xattr_cnt;
+	}
+
+	if (ubifs_authenticated(c))
+		write_len += ALIGN(ilen, 8) + ubifs_auth_node_sz(c);
+	else
+		write_len += ilen;
+
+	ino_start = ino = kmalloc(write_len, GFP_NOFS);
+	if (!ino) {
+		err = -ENOMEM;
+		goto out_iput;
+	}
+
+	/* Make reservation before allocating sequence numbers */
+	err = make_reservation(c, BASEHD, write_len);
+	if (err)
+		goto out_free;
+
+	if (kill_xattrs) {
+		for (i = 0; i < ui->xattr_cnt; i++) {
+			clear_nlink(xinos[i]);
+			pack_inode(c, ino, xinos[i], 0);
+			ino = (void *)ino + UBIFS_INO_NODE_SZ;
+			iput(xinos[i]);
+		}
+
+		kfree(xinos);
+		xinos = NULL;
 	}
 
 	pack_inode(c, ino, inode, 1);
@@ -1103,6 +1121,12 @@ int ubifs_jnl_write_inode(struct ubifs_info *c, const struct inode *inode)
 	finish_reservation(c);
 out_free:
 	kfree(ino_start);
+out_iput:
+	if (xinos) {
+		while (--i >= 0)
+			iput(xinos[i]);
+		kfree(xinos);
+	}
 	return err;
 }
 
