propagate_one(): mnt_set_mountpoint() needs mount_lock
... to protect the modification of mp->m_count done by it. Most of
the places that modify that thing also have namespace_lock held,
but not all of them can do so, so we really need mount_lock here.
Kudos to Piotr Krysiuk <firstname.lastname@example.org>, who'd spotted a related
bug in pivot_root(2) (fixed unnoticed in 5.3); search for other
similar turds has caught out this one.
Signed-off-by: Al Viro <email@example.com>
1 file changed