The lsm module implementes sb_umount() hook to disable lazy umounts. When access is denied, all consecutive umounts fail. It looks like mount reference count is messed up when sb_umount() return -EPERM. Is it possible that umount syscall assumes do_umount() touches those references and it calls
dput(path.dentry);
mntput_no_expire(mnt);
regardless of what do_mount() returns?
Thanks,
--Alex