Al Viro <viro@ZenIV.linux.org.uk> writes:

> On Sun, Sep 23, 2012 at 07:30:38AM +0100, Al Viro wrote:
>> On Sat, Sep 22, 2012 at 10:59:04PM -0700, Eric W. Biederman wrote:
>> 
>> > The test:
>> > >> +	if (filp->f_vfsmnt->mnt_root == filp->f_dentry)
>> > kicks in and no redirection is performed.
>> 
>> Umm...  OK, after the first round of recursion.  Unless you bind /something/pts
>> on /something.
>
> Other way round, of course...  E.g.
> mount --bind /dev /dev/pts
> mount --bind /dev /dev/pts/pts
> etc. enough times to overflow the kernel stack on recursion.

Except of course I gave the wrong explanation.

I did the open with O_PATH.  Since O_PATH never calls open recursion
is impossible.

Eric