1 files changed, 22 insertions, 24 deletions
diff --git a/pkg/sentry/fs/mounts.go b/pkg/sentry/fs/mounts.go
index 1e6b5b70e..87da4ee0e 100644
--- a/pkg/sentry/fs/mounts.go
+++ b/pkg/sentry/fs/mounts.go
@@ -272,31 +272,8 @@ func (mns *MountNamespace) Unmount(ctx context.Context, node *Dirent, detachOnly
 			panic("cannot unmount initial dirent")
 		}
 
+		m := node.Inode.MountSource
 		if !detachOnly {
-			m := node.Inode.MountSource
-
-			// Lock the parent MountSource first, if it exists. We are
-			// holding mns.Lock, so the parent can not change out
-			// from under us.
-			parent := m.Parent()
-			if parent != nil {
-				parent.mu.Lock()
-				defer parent.mu.Unlock()
-			}
-
-			// Lock the mount that is being unmounted.
-			m.mu.Lock()
-			defer m.mu.Unlock()
-
-			if m.parent != nil {
-				// Sanity check.
-				if _, ok := m.parent.children[m]; !ok {
-					panic(fmt.Sprintf("mount %+v is not a child of parent %+v", m, m.parent))
-				}
-				delete(m.parent.children, m)
-				m.parent = nil
-			}
-
 			// Flush all references on the mounted node.
 			m.FlushDirentRefs()
 
@@ -315,6 +292,27 @@ func (mns *MountNamespace) Unmount(ctx context.Context, node *Dirent, detachOnly
 			}
 		}
 
+		// Lock the parent MountSource first, if it exists. We are
+		// holding mns.Lock, so the parent can not change out
+		// from under us.
+		parent := m.Parent()
+		if parent != nil {
+			parent.mu.Lock()
+			defer parent.mu.Unlock()
+		}
+
+		// Lock the mount that is being unmounted.
+		m.mu.Lock()
+		defer m.mu.Unlock()
+
+		if m.parent != nil {
+			// Sanity check.
+			if _, ok := m.parent.children[m]; !ok {
+				panic(fmt.Sprintf("mount %+v is not a child of parent %+v", m, m.parent))
+			}
+			delete(m.parent.children, m)
+		}
+
 		original := origs[len(origs)-1]
 		if err := node.unmount(ctx, original); err != nil {
 			return err