On Tue, Jun 24, 2025 at 02:48:53PM +0800, Ian Kent wrote: > + for (p = mnt; p; p = next_mnt(p, mnt)) { > + unsigned int f = 0; > + > + if (p->mnt_mountpoint != mnt->mnt.mnt_root) { ??? The loop goes over everything mounted on mnt, no matter how deep it is. Do you mean "p is mounted on the root of its parent", or is it "p is mounted on some mount of the same fs, with mountpoint that just happens to be equal to root dentry of mnt (which may be not the mount p is mounted on)"? > + /* p is a covering mnt, need to check if p or any of its > + * children are in use. A reference to p is not held so > + * don't pass TREE_BUSY_REFERENCED to the propagation > + * helper. > + */ ... so for these you keep walking through the subtree on them (nevermind that outer loop will walk it as well)... > + for (q = p; q; q = next_mnt(q, p)) { > + if (propagate_mount_tree_busy(q, f)) { > + busy = true; > + break; > + } ... and yet you still keep going in the outer loop? Confused... > } > unlock_mount_hash(); > + up_read(&namespace_sem); > + * count greater than the minimum reference count (ie. are in use). > + */ > +int propagate_mount_tree_busy(struct mount *mnt, unsigned int flags) > +{ > + struct mount *m; > + struct mount *parent = mnt->mnt_parent; > + int refcnt = flags & TREE_BUSY_REFERENCED ? 2 : 1; > + > + if (do_refcount_check(mnt, refcnt)) > + return 1; > + > + for (m = propagation_next(parent, parent); m; > + m = propagation_next(m, parent)) { > + struct mount *child; > + > + child = __lookup_mnt(&m->mnt, mnt->mnt_mountpoint); > + if (!child) > + continue; > + > + if (do_refcount_check(child, 1)) > + return 1; > + } > + return 0; > +} What is the daemon expected to do with your subtree? Take it apart with a series of sync (== non-lazy) umount(2)? I presume it is normal for it to run into -EBUSY halfway through - i.e. get rid of some, but not all of the subtree, right?