Hello, We found a data race that could happen between clone_mnt() and mnt_hold_writers() over mnt->mnt.mnt_flags. The two functions can write to mnt->mnt.mnt_flags concurrently. Although mnt_hold_writers() holds the lock_mount_hash(), clone_mnt() does not respect this lock at this moment (it will apply for this lock later). Thread-1 Thread-2 // clone_mnt() // mnt_hold_writers() holding lock_mount_hash() mnt->mnt.mnt_flags &= ~(MNT_WRITE_HOLD|MNT_MARKED|MNT_INTERNAL); mnt->mnt.mnt_flags |= MNT_WRITE_HOLD; It is not clear whether this is a serious problem but we would like to report it just in case. Thanks, Sishuai
