There is a ref count problem in fs/namei.c:do_lookup().
When walking in ref-walk mode, if follow_managed() returns a fail we
need to drop dentry and possibly vfsmount.  Clean up properly,
as we do in the other caller of follow_managed().
Signed-off-by: Ian Kent <raven@themaw.net>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
        path->mnt = mnt;
        path->dentry = dentry;
        err = follow_managed(path, nd->flags);
-       if (unlikely(err < 0))
+       if (unlikely(err < 0)) {
+               path_put_conditional(path, nd);
                return err;
+       }
        *inode = path->dentry->d_inode;
        return 0;