FWIW, I did some more testing yesterday. I did the reproducer on a kernel both with and without commit 36d43a437, and used crash to look at the d_count after triggering the mount and before the unmount. Those counts were the same in both cases -- the mnt_root had a d_count of 2, and s_root a d_count of 1.
Perhaps I should do it again and have a look at the d_flags, or just get the entire dentry structs in both cases so we can compare them.
FWIW, I did some more testing yesterday. I did the reproducer on a kernel both with and without commit 36d43a437, and used crash to look at the d_count after triggering the mount and before the unmount. Those counts were the same in both cases -- the mnt_root had a d_count of 2, and s_root a d_count of 1.
Perhaps I should do it again and have a look at the d_flags, or just get the entire dentry structs in both cases so we can compare them.