copy_mnt_ns(): handle a corner case (overmounted mntns bindings) saner

copy_mnt_ns() has the old tree copied, with mntns binding *and* anything
bound on top of them skipped.  Then it proceeds to walk both trees in
parallel.  Unfortunately, it doesn't get the "skip the stuff we'd skipped
when copying" quite right.  Consequences are minor (the ->mnt_root
comparison will return the situation to sanity pretty soon and the worst
we get is the unexpected subset of opened non-directories being switched
to new namespace), but it's confusing enough and it's not hard to get
the expected behaviour...

Signed-off-by: Al Viro <[email protected]>

diff --git a/fs/namespace.c b/fs/namespace.c
index df137ba19d3756bd08d544f0d7e95eb52cb4869c..c80f422084eb038ef666af201f2956a0aaf73673 100644 (file)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -3515,8 +3515,9 @@ struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns,
                q = next_mnt(q, new);
                if (!q)
                        break;
+               // an mntns binding we'd skipped?
                while (p->mnt.mnt_root != q->mnt.mnt_root)
-                       p = next_mnt(p, old);
+                       p = next_mnt(skip_mnt_tree(p), old);
        }
        namespace_unlock();