don't drop newmnt on error in do_add_mount()

That gets rid of the kludge in finish_automount() - we need
to keep refcount on the vfsmount as-is until we evict it from
expiry list.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

diff --git a/fs/namespace.c b/fs/namespace.c
index bec51e4e0549d917ceb72af5d5b1346475ca5a2d..31aefc8e5fa65808e3aaaa66064a0f9f42a288ae 100644 (file)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1880,6 +1880,7 @@ static int do_new_mount(struct path *path, char *type, int flags,
                        int mnt_flags, char *name, void *data)
 {
        struct vfsmount *mnt;
+       int err;
 
        if (!type)
                return -EINVAL;
@@ -1892,7 +1893,10 @@ static int do_new_mount(struct path *path, char *type, int flags,
        if (IS_ERR(mnt))
                return PTR_ERR(mnt);
 
-       return do_add_mount(mnt, path, mnt_flags);
+       err = do_add_mount(mnt, path, mnt_flags);
+       if (err)
+               mntput(mnt);
+       return err;
 }
 
 int finish_automount(struct vfsmount *m, struct path *path)
@@ -1911,26 +1915,17 @@ int finish_automount(struct vfsmount *m, struct path *path)
                return -ELOOP;
        }
 
-       /* We need to add the mountpoint to the parent.  The filesystem may
-        * have placed it on an expiry list, and so we need to make sure it
-        * won't be expired under us if do_add_mount() fails (do_add_mount()
-        * will eat a reference unconditionally).
-        */
-       mntget(m);
        err = do_add_mount(m, path, path->mnt->mnt_flags | MNT_SHRINKABLE);
        if (err) {
                mnt_clear_expiry(m);
                mntput(m);
                mntput(m);
-       } else {
-               mntput(m);
        }
        return err;
 }
 
 /*
  * add a mount into a namespace's mount tree
- * - this unconditionally eats one of the caller's references to newmnt.
  */
 int do_add_mount(struct vfsmount *newmnt, struct path *path, int mnt_flags)
 {
@@ -1967,7 +1962,6 @@ int do_add_mount(struct vfsmount *newmnt, struct path *path, int mnt_flags)
 
 unlock:
        up_write(&namespace_sem);
-       mntput(newmnt);
        return err;
 }