Commit 61d8e426 authored by Al Viro's avatar Al Viro
Browse files

copy_mnt_ns(): handle a corner case (overmounted mntns bindings) saner 



copy_mnt_ns() has the old tree copied, with mntns binding *and* anything
bound on top of them skipped.  Then it proceeds to walk both trees in
parallel.  Unfortunately, it doesn't get the "skip the stuff we'd skipped
when copying" quite right.  Consequences are minor (the ->mnt_root
comparison will return the situation to sanity pretty soon and the worst
we get is the unexpected subset of opened non-directories being switched
to new namespace), but it's confusing enough and it's not hard to get
the expected behaviour...

Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 9abf2313

fs/namespace.c

+2 −1
Original line number Diff line number Diff line
@@ -3515,8 +3515,9 @@ struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns, 
		q = next_mnt(q, new);

		if (!q)

			break;

		// an mntns binding we'd skipped?

		while (p->mnt.mnt_root != q->mnt.mnt_root)

			p = next_mnt(p, old);

			p = next_mnt(skip_mnt_tree(p), old);

	}

	namespace_unlock();