do_add_mount() consumes vfsmount on success; just follow it with conditional retain_and_null_ptr() on success and we can switch to __free() for mnt and be done with that - unlock_mount() is in the very end. Signed-off-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx> --- fs/namespace.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/fs/namespace.c b/fs/namespace.c index 6251ee15f5f6..3551e51461a2 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -3696,7 +3696,7 @@ static int do_new_mount_fc(struct fs_context *fc, struct path *mountpoint, { struct pinned_mountpoint mp = {}; struct super_block *sb; - struct vfsmount *mnt = fc_mount(fc); + struct vfsmount *mnt __free(mntput) = fc_mount(fc); int error; if (IS_ERR(mnt)) @@ -3704,10 +3704,11 @@ static int do_new_mount_fc(struct fs_context *fc, struct path *mountpoint, sb = fc->root->d_sb; error = security_sb_kern_mount(sb); - if (!error && mount_too_revealing(sb, &mnt_flags)) - error = -EPERM; if (unlikely(error)) - goto out; + return error; + + if (unlikely(mount_too_revealing(sb, &mnt_flags))) + return -EPERM; mnt_warn_timestamp_expiry(mountpoint, mnt); @@ -3716,11 +3717,9 @@ static int do_new_mount_fc(struct fs_context *fc, struct path *mountpoint, error = do_add_mount(real_mount(mnt), mp.mp, mountpoint, mnt_flags); if (!error) - mnt = NULL; // consumed on success + retain_and_null_ptr(mnt); // consumed on success unlock_mount(&mp); } -out: - mntput(mnt); return error; } -- 2.47.2