don't drop newmnt on error in do_add_mount()

That gets rid of the kludge in finish_automount() - we need
to keep refcount on the vfsmount as-is until we evict it from
expiry list.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

1 files changed, 5 insertions, 11 deletions

diff --git a/fs/namespace.c b/fs/namespace.c
index bec51e4e0549..31aefc8e5fa6 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1880,6 +1880,7 @@ static int do_new_mount(struct path *path, char *type, int flags,
                         int mnt_flags, char *name, void *data)
 {
         struct vfsmount *mnt;
+        int err;
 
         if (!type)
                 return -EINVAL;
@@ -1892,7 +1893,10 @@ static int do_new_mount(struct path *path, char *type, int flags,
         if (IS_ERR(mnt))
                 return PTR_ERR(mnt);
 
-        return do_add_mount(mnt, path, mnt_flags);
+        err = do_add_mount(mnt, path, mnt_flags);
+        if (err)
+                mntput(mnt);
+        return err;
 }
 
 int finish_automount(struct vfsmount *m, struct path *path)
@@ -1911,26 +1915,17 @@ int finish_automount(struct vfsmount *m, struct path *path)
                 return -ELOOP;
         }
 
-        /* We need to add the mountpoint to the parent.  The filesystem may
-         * have placed it on an expiry list, and so we need to make sure it
-         * won't be expired under us if do_add_mount() fails (do_add_mount()
-         * will eat a reference unconditionally).
-         */
-        mntget(m);
         err = do_add_mount(m, path, path->mnt->mnt_flags | MNT_SHRINKABLE);
         if (err) {
                 mnt_clear_expiry(m);
                 mntput(m);
                 mntput(m);
-        } else {
-                mntput(m);
         }
         return err;
 }
 
 /*
  * add a mount into a namespace's mount tree
- * - this unconditionally eats one of the caller's references to newmnt.
  */
 int do_add_mount(struct vfsmount *newmnt, struct path *path, int mnt_flags)
 {
@@ -1967,7 +1962,6 @@ int do_add_mount(struct vfsmount *newmnt, struct path *path, int mnt_flags)
 
 unlock:
         up_write(&namespace_sem);
-        mntput(newmnt);
         return err;
 }