diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 20c60ddaa5a1..3e20831119a9 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2788,9 +2788,9 @@ build_unc_path_to_root(const struct smb_vol *volume_info,
 /*
  * Perform a dfs referral query for a share and (optionally) prefix
  *
- * If a referral is found, mount_data will be set to point at a newly
- * allocated string containing updated options for the submount.
- * Otherwise it will be left untouched.
+ * If a referral is found, cifs_sb->mountdata will be (re-)allocated
+ * to a string containing updated options for the submount.  Otherwise it
+ * will be left untouched.
  *
  * Returns the rc from get_dfs_path to the caller, which can be used to
  * determine whether there were referrals.
@@ -2798,7 +2798,7 @@ build_unc_path_to_root(const struct smb_vol *volume_info,
 static int
 expand_dfs_referral(int xid, struct cifsSesInfo *pSesInfo,
 		    struct smb_vol *volume_info, struct cifs_sb_info *cifs_sb,
-		    char **mount_data, int check_prefix)
+		    int check_prefix)
 {
 	int rc;
 	unsigned int num_referrals = 0;
@@ -2826,11 +2826,14 @@ expand_dfs_referral(int xid, struct cifsSesInfo *pSesInfo,
 		free_dfs_info_array(referrals, num_referrals);
 		kfree(fake_devname);
 
+		if (cifs_sb->mountdata != NULL)
+			kfree(cifs_sb->mountdata);
+
 		if (IS_ERR(mdata)) {
 			rc = PTR_ERR(mdata);
 			mdata = NULL;
 		}
-		*mount_data = mdata;
+		cifs_sb->mountdata = mdata;
 	}
 	kfree(full_path);
 	return rc;
@@ -2853,6 +2856,7 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
 #ifdef CONFIG_CIFS_DFS_UPCALL
 	int referral_walks_count = 0;
 try_mount_again:
+	mount_data = cifs_sb->mountdata;
 
 	/* cleanup activities if we're chasing a referral */
 	if (referral_walks_count) {
@@ -2986,7 +2990,7 @@ remote_path_check:
 	 */
 	if (referral_walks_count == 0) {
 		int refrc = expand_dfs_referral(xid, pSesInfo, volume_info,
-						cifs_sb, &mount_data, false);
+						cifs_sb, false);
 		if (!refrc) {
 			referral_walks_count++;
 			goto try_mount_again;
@@ -3028,17 +3032,13 @@ remote_path_check:
 			convert_delimiter(cifs_sb->prepath,
 					CIFS_DIR_SEP(cifs_sb));
 
-		if (mount_data != mount_data_global)
-			kfree(mount_data);
-
 		rc = expand_dfs_referral(xid, pSesInfo, volume_info, cifs_sb,
-					 &mount_data, true);
+					 true);
 
 		if (!rc) {
 			referral_walks_count++;
 			goto try_mount_again;
 		}
-		mount_data = NULL;
 		goto mount_fail_check;
 #else /* No DFS support, return error on mount */
 		rc = -EOPNOTSUPP;
@@ -3072,8 +3072,6 @@ remote_path_check:
 mount_fail_check:
 	/* on error free sesinfo and tcon struct if needed */
 	if (rc) {
-		if (mount_data != mount_data_global)
-			kfree(mount_data);
 		/* If find_unc succeeded then rc == 0 so we can not end */
 		/* up accidentally freeing someone elses tcon struct */
 		if (tcon)