copy_mnt_ns(): handle a corner case (overmounted mntns bindings) saner

copy_mnt_ns() has the old tree copied, with mntns binding *and* anything
bound on top of them skipped.  Then it proceeds to walk both trees in
parallel.  Unfortunately, it doesn't get the "skip the stuff we'd skipped
when copying" quite right.  Consequences are minor (the ->mnt_root
comparison will return the situation to sanity pretty soon and the worst
we get is the unexpected subset of opened non-directories being switched
to new namespace), but it's confusing enough and it's not hard to get
the expected behaviour...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

fs/namespace.c

@@ -3515,8 +3515,9 @@ struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns,
 		q = next_mnt(q, new);
 		if (!q)
 			break;
+		// an mntns binding we'd skipped?
 		while (p->mnt.mnt_root != q->mnt.mnt_root)
-			p = next_mnt(p, old);
+			p = next_mnt(skip_mnt_tree(p), old);
 	}
 	namespace_unlock();