Re: [PATCH] Bug in do_mount()

[Jorgen Cederlof]

> >       if (list_empty(&sb->s_mounts))
> >               kill_super(sb, 0);
> > +     else
> > +             put_filesystem(fstype);
> >       goto unlock_out;
 
> Reference acquired by get_fs_type() is
> released by put_filesystem() (near fs_out), _NOT_ by kill_super().

Yes.

> kill_super() releases the reference stored in ->s_type (created
> by get_sb_...()). If superblock stays alive you should not release it.

get_sb_...() will do get_filesystem() even if superblock stays alive.

We get the filesystem twice, in get_fs_type() and get_sb_...(), but if
we goto 'fail:' and don't call kill_super(), we put the filesystem
only once (near fs_out). 

> What bug are you trying to fix?

foofs is a FS_SINGLE filesystem: 
(but the !nd.dentry->d_inode case should be no different)

# grep foofs /proc/modules 
foofs                 6736   0 (unused)
# mount NONE /mnt -t foofs
# grep foofs /proc/modules 
foofs                 6736   1
# mount NONE /mnt -t foofs
mount: NONE already mounted or /mnt busy
mount: according to mtab, NONE is already mounted on /mnt
# grep foofs /proc/modules 
foofs                 6736   2
# mount NONE /mnt -t foofs
mount: NONE already mounted or /mnt busy
mount: according to mtab, NONE is already mounted on /mnt
# grep foofs /proc/modules 
foofs                 6736   3
# umount /mnt
# grep foofs /proc/modules 
foofs                 6736   2
# umount /mnt
umount: /mnt: not mounted
# grep foofs /proc/modules 
foofs                 6736   2
# rmmod foofs
foofs: Device or resource busy