Bug report: Strange behaviour with nested bind mounts

Bug report: Strange behaviour with nested bind mounts

[Charles Baylis]

[I think this is fsdevel material, please let me know if I should be
posting elsewhere]

I have been investigating some odd failures in Jenkins CI set up,
where expect reports 'Out of ptys'. The cause seems to be that when
schroot sessions are terminated, the unmount of
/path/to/chroot/dev/pts affects the wrong mount point.

I can reproduce the problem like this:

(using Xubuntu15.10 LiveCD inside qemu, same thing with Fedora and mainline 4.3)
root@xubuntu:~# uname -a
Linux xubuntu 4.2.0-16-generic #19-Ubuntu SMP Thu Oct 8 15:35:06 UTC
2015 x86_64 x86_64 x86_64 GNU/Linux
root@xubuntu:~# mkdir tmp1 tmp2
root@xubuntu:~# mount -o bind /dev tmp1
root@xubuntu:~# mount -o bind /dev/pts tmp1/pts
root@xubuntu:~# mount -o bind /dev tmp2
root@xubuntu:~# mount -o bind /dev/pts tmp2/pts
root@xubuntu:~# ls tmp1/pts
0  2  3  4  5  6  7  ptmx
root@xubuntu:~# ls tmp2/pts
0  2  3  4  5  6  7  ptmx
root@xubuntu:~# umount tmp1/pts
root@xubuntu:~# ls tmp1/pts     # <--- expect this to be empty
0  2  3  4  5  6  7  ptmx
root@xubuntu:~# ls tmp2/pts     # <--- expect some pty device nodes
root@xubuntu:~#

It appears that "umount tmp1/pts" actually unmounted tmp2/pts.

Also interesting to note is the strange contents of /proc/mounts after
the 4 mount commands
root@xubuntu:~# mount -o bind /dev tmp1
root@xubuntu:~# mount -o bind /dev/pts tmp1/pts
root@xubuntu:~# mount -o bind /dev tmp2
root@xubuntu:~# mount -o bind /dev/pts tmp2/pts
root@xubuntu:~# grep pts /proc/mounts
devpts /dev/pts devpts rw,nosuid,noexec,relatime,mode=600,ptmxmode=000 0 0
devpts /home/xubuntu/tmp1/pts devpts
rw,nosuid,noexec,relatime,mode=600,ptmxmode=000 0 0
devpts /dev/pts devpts rw,nosuid,noexec,relatime,mode=600,ptmxmode=000 0 0
devpts /home/xubuntu/tmp2/pts devpts
rw,nosuid,noexec,relatime,mode=600,ptmxmode=000 0 0
devpts /dev/pts devpts rw,nosuid,noexec,relatime,mode=600,ptmxmode=000 0 0
devpts /home/xubuntu/tmp1/pts devpts
rw,nosuid,noexec,relatime,mode=600,ptmxmode=000 0 0

/dev/pts appears to be mounted 3 times, and tmp1/pts is mounted twice.

Using Ubuntu 14.04, I get this result, which is what I expect to see:
root@sale:/root# uname -a
Linux sale 3.13.0-71-generic #114-Ubuntu SMP Tue Dec 1 02:34:22 UTC
2015 x86_64 x86_64 x86_64 GNU/Linux
root@sale:/root# mount -o bind /dev tmp1
root@sale:/root# mount -o bind /dev/pts tmp1/pts
root@sale:/root# mount -o bind /dev tmp2
root@sale:/root# mount -o bind /dev/pts tmp2/pts
root@sale:/root# grep pts /proc/mounts
devpts /dev/pts devpts rw,nosuid,noexec,relatime,mode=600,ptmxmode=000 0 0
devpts /root/tmp1/pts devpts rw,nosuid,noexec,relatime,mode=600,ptmxmode=000 0 0
devpts /root/tmp2/pts devpts rw,nosuid,noexec,relatime,mode=600,ptmxmode=000 0 0

It would be useful to know whether this is invalid use of bind mounts,
or if it's really a bug.

Thanks
Charles