attach_recursive_mnt(): do not lock the covering tree when sliding something under it

[ Upstream commit ce7df19686530920f2f6b636e71ce5eb1d9303ef ]

If we are propagating across the userns boundary, we need to lock the
mounts added there.  However, in case when something has already
been mounted there and we end up sliding a new tree under that,
the stuff that had been there before should not get locked.

IOW, lock_mnt_tree() should be called before we reparent the
preexisting tree on top of what we are adding.

Fixes: 3bd045cc9c4b ("separate copying and locking mount tree on cross-userns copies")
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/fs/namespace.c b/fs/namespace.c
index eab9185e228584faf94076f35a74f69e5f1e688d..cebcb9fa2acc07d50ed2b93a64bc92e6e1d70859 100644 (file)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2364,14 +2364,14 @@ static int attach_recursive_mnt(struct mount *source_mnt,
        hlist_for_each_entry_safe(child, n, &tree_list, mnt_hash) {
                struct mount *q;
                hlist_del_init(&child->mnt_hash);
-               q = __lookup_mnt(&child->mnt_parent->mnt,
-                                child->mnt_mountpoint);
-               if (q)
-                       mnt_change_mountpoint(child, smp, q);
                /* Notice when we are propagating across user namespaces */
                if (child->mnt_parent->mnt_ns->user_ns != user_ns)
                        lock_mnt_tree(child);
                child->mnt.mnt_flags &= ~MNT_LOCKED;
+               q = __lookup_mnt(&child->mnt_parent->mnt,
+                                child->mnt_mountpoint);
+               if (q)
+                       mnt_change_mountpoint(child, smp, q);
                commit_tree(child);
        }
        put_mountpoint(smp);