There's something seriously screwed up with nfs4_closedata and path_get()/path_put() in nfs4_do_close()/nfs4_free_closedata(). Look: either we never call the latter before all preexisting references to data->path.mnt are dropped, in which case we don't need to grab/put the damn thing at all. *OR* it is possible, in which case that data->path.mnt might be the only thing that still holds nfs.ko pinned down and right after the path_put() we might be running code in a module with refcount 0. Which is not a good thing... Note that extra references to vfsmount do not prevent umount from removing the sucker from the tree and dropping the preexisting reference to it. umount -l will do that just fine. This thing is called as ->rpc_release(); do we have anything protecting the issuer of rpc_run_task() from being rmmod'ed before (or during) the call of ->rpc_release()? -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
