vfs: cleanup path_to_nameidata()

diff -puN fs/namei.c~namei-path_to_nameidata-cleanup fs/namei.c
@@ -541,9 +541,10 @@ static void path_put_conditional(struct 
 static inline void path_to_nameidata(struct path *path, struct nameidata *nd)
 {
 	dput(nd->path.dentry);
-	if (nd->path.mnt != path->mnt)
+	if (nd->path.mnt != path->mnt) {
 		mntput(nd->path.mnt);
-	nd->path.mnt = path->mnt;
+		nd->path.mnt = path->mnt;
+	}
 	nd->path.dentry = path->dentry;
 }
 

diff -puN fs/namei.c~namei-do_filp_open-fix fs/namei.c
@@ -548,6 +548,18 @@ static inline void path_to_nameidata(str
 	nd->path.dentry = path->dentry;
 }
 
+/* NOTE: this is intended as special operation for __do_follow_link() */
+static inline void path_unshare_refcnt(struct path *path, struct nameidata *nd)
+{
+	if (path->mnt == nd->path.mnt)
+		mntget(path->mnt);
+}
+
+/*
+ * The caller should take special care about path and nd->path
+ * reference count. (e.g. to make simple error path, call
+ * path_unshare_refcnt() before this, etc.)
+ */
 static __always_inline int __do_follow_link(struct path *path, struct nameidata *nd)
 {
 	int error;

@@ -559,9 +571,8 @@ static __always_inline int __do_follow_l
 
 	if (path->mnt != nd->path.mnt) {
 		path_to_nameidata(path, nd);
-		dget(dentry);
+		path_get(path);
 	}
-	mntget(path->mnt);
 	cookie = dentry->d_inode->i_op->follow_link(dentry, nd);
 	error = PTR_ERR(cookie);
 	if (!IS_ERR(cookie)) {

@@ -602,6 +613,7 @@ static inline int do_follow_link(struct 
 	current->link_count++;
 	current->total_link_count++;
 	nd->depth++;
+	path_unshare_refcnt(path, nd);
 	err = __do_follow_link(path, nd);
 	path_put(path);
 	current->link_count--;

@@ -1856,6 +1868,7 @@ do_link:
 		goto exit_dput;
 	save = nd.path;
 	path_get(&save);
+	path_unshare_refcnt(&path, &nd);
 	error = __do_follow_link(&path, &nd);
 	if (error == -ESTALE) {
 		/* nd.path had been dropped */