From: <bigfish@asmallpond.org>

http://bugzilla.kernel.org/show_bug.cgi?id=4857

pivot_root from initramfs causes circular reference in mount tree

When pivot_root is called from an init script in an initramfs environment,
it causes a circular reference in the mount tree.  I was able to see this
by adding some debug printk's to the detach_mnt and attach_mnt functions. 
When pivot_root runs, the output was:

detach_mnt: mnt=d7ee3300, old_nd=d7d39ee8
detach_mnt: mnt=d7ee3780, old_nd=d7d39ea8
attach_mnt: mnt=d7ee3780, nd=d7d39f28
            mnt->mnt_parent=d7ee3300
attach_mnt: mnt=d7ee3300, nd=d7d39ea8
            mnt->mnt_parent=d7ee3780

Notice the mnt_parent assignments in attach_mnt.

The effect of this bug can be seen when the user tries to umount the
initramfs, or if mount --move is used later.  In either case, the kernel
gets stuck in an endless loop.

The best patch I can come up with for this is below.  It passes the WOMM
test, and preserves the behavior when pivot_root is used from an initrd (or
another filesystem below the rootfs), while fixing the problem when it is
the rootfs that is being pivoted.  But maybe something needs to be done
with current->namespace->root as well in this case?

Cc: Christoph Hellwig <hch@lst.de>
Cc: <viro@parcelfarce.linux.theplanet.co.uk>
Cc: Miklos Szeredi <miklos@szeredi.hu>
Signed-off-by: Andrew Morton <akpm@osdl.org>
---

 fs/namespace.c |    2 ++
 1 files changed, 2 insertions(+)

diff -puN fs/namespace.c~pivot_root-circular-reference-fix fs/namespace.c
--- 25/fs/namespace.c~pivot_root-circular-reference-fix	Mon Jul 11 15:04:37 2005
+++ 25-akpm/fs/namespace.c	Mon Jul 11 15:05:02 2005
@@ -1352,6 +1352,8 @@ asmlinkage long sys_pivot_root(const cha
 		goto out3;
 	detach_mnt(new_nd.mnt, &parent_nd);
 	detach_mnt(user_nd.mnt, &root_parent);
+	if (user_nd.mnt == current->namespace->root)
+		root_parent.mnt = new_nd.mnt; /* avoid creating a mount loop */
 	attach_mnt(user_nd.mnt, &old_nd);     /* mount old root on put_old */
 	attach_mnt(new_nd.mnt, &root_parent); /* mount new_root on / */
 	spin_unlock(&vfsmount_lock);
_