On Mon, Jul 11, 2022 at 11:37:46AM +0800, Ian Kent wrote: > +static int do_mount_in_use_check(struct mount *mnt, int cnt) > +{ > + struct mount *topper; > + > + /* Is there exactly one mount on the child that covers > + * it completely? > + */ > + topper = find_topper(mnt); > + if (topper) { > + int topper_cnt = topper->mnt_mounts_cnt + 1; > + > + /* Open file or pwd within singular mount? */ > + if (do_refcount_check(topper, topper_cnt)) > + return 1; Whatever the hell for? umount(2) will be able to slide the underlying mount from under the topper, whatever the refcount of topper might have been.