On Sun, Jul 7, 2019 at 2:40 PM Al Viro <viro@xxxxxxxxxxxxxxxxxx> wrote: > > It is namespace_sem. Of all put_mountpoint() callers only the one > from mntput_no_expire() (disposing of stuck MNT_LOCKed children) > is not under namespace_sem; > > list_for_each_entry_safe(p, tmp, &mnt->mnt_mounts, mnt_child) { > - umount_mnt(p); > + umount_mnt(p, &list); > } > in mntput_no_expire() passes a local list to umount_mnt() (which passes it > to put_mountpoint()). Ahh. Ok. This would be better with a comment. Maybe a separate helper function with that comment and the special case of passing in NULL (or maybe not pass in NULL at all, but pass in ex_mountpoints?). Different locking requirements depending on argument values is very confusing and easily overlooked.. Linus