Re: [PATCH 2/6] nfsd: release path refs on follow_down() error

[Jeff Layton <jlayton@kernel.org>]

On Mon, 2026-06-01 at 19:47 +0100, Al Viro wrote:
> On Sun, May 31, 2026 at 08:06:59AM -0400, Jeff Layton wrote:
> 
> 
> > Fix by calling path_put(&path) before the goto out in the err < 0
> > arm so the entry-time refs are released on all follow_down() error
> > returns.
> 
> Might be better to unify all those path_put()...  Something like this,
> perhaps?
> 
> diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
> index eafdf7b7890f..bdcd78f49112 100644
> --- a/fs/nfsd/vfs.c
> +++ b/fs/nfsd/vfs.c
> @@ -141,13 +141,13 @@ nfsd_cross_mnt(struct svc_rqst *rqstp, struct dentry **dpp,
>  	if (path.mnt == exp->ex_path.mnt && path.dentry == dentry &&
>  	    nfsd_mountpoint(dentry, exp) == 2) {
>  		/* This is only a mountpoint in some other namespace */
> -		path_put(&path);
>  		goto out;
>  	}
>  
>  	exp2 = rqst_exp_get_by_name(rqstp, &path);
>  	if (IS_ERR(exp2)) {
>  		err = PTR_ERR(exp2);
> +		exp2 = NULL;
>  		/*
>  		 * We normally allow NFS clients to continue
>  		 * "underneath" a mountpoint that is not exported.
> @@ -157,10 +157,7 @@ nfsd_cross_mnt(struct svc_rqst *rqstp, struct dentry **dpp,
>  		 */
>  		if (err == -ENOENT && !(exp->ex_flags & NFSEXP_V4ROOT))
>  			err = 0;
> -		path_put(&path);
> -		goto out;
> -	}
> -	if (nfsd_v4client(rqstp) ||
> +	} else if (nfsd_v4client(rqstp) ||
>  		(exp->ex_flags & NFSEXP_CROSSMOUNT) || EX_NOHIDE(exp2)) {
>  		/* successfully crossed mount point */
>  		/*
> @@ -174,9 +171,10 @@ nfsd_cross_mnt(struct svc_rqst *rqstp, struct dentry **dpp,
>  		*expp = exp2;
>  		exp2 = exp;
>  	}
> -	path_put(&path);
> -	exp_put(exp2);
>  out:
> +	path_put(&path);
> +	if (exp2)
> +		exp_put(exp2);
>  	return err;
>  }
>  

Looks reasonable. Chuck has already taken this patch into his tree, but
we could do a cleanup on top. Want to send us an "official" patch?

Thanks,
-- 
Jeff Layton <jlayton@kernel.org>