If a client mounts a subdirectory of an export using NFSv3, the server can end up with invalid (CACHE_VALID bit unset) entries in its export cache. These entries indirectly have a reference to the struct mount* containing the export, preventing the filesystem containing the export from being unmounted, even after the export has been unexported: /tmp# mount --bind foo bar /tmp# exportfs -o fsid=7 '*:/tmp/bar' /tmp# mount -t nfs -o vers=3 localhost:/tmp/bar/a /mnt/a /tmp# umount /mnt/a /tmp# exportfs -u '*:/tmp/bar' /tmp# umount /tmp/bar umount: /tmp/bar: target is busy. /tmp# cat /proc/net/rpc/nfsd.export/content #path domain(flags) # /tmp/bar/a *() It looks like what's happening is that when rpc.mountd does a downcall to get a filehandle corresponding to a particular path, exp_parent() traverses the elements in the given path looking for one which is in the export cache. If there isn't a valid entry in the cache for the given path, which there won't be for a subdirectory of an export, then sunrpc_cache_lookup_rcu() inserts an new, invalid entry. Are the invalid entries inserted while executing exp_parent() useful? Could we prevent them from being added? Thanks, John