Fix cwd/root update method during namespace cloning.

The previous implementation incorrectly assumed order would be preserved
in the map.

Reported-by: syzbot+da2bc2bee99641f22de4@syzkaller.appspotmail.com
PiperOrigin-RevId: 563529897

pkg/sentry/vfs/namespace.go

@@ -15,8 +15,6 @@
 package vfs
 
 import (
-	"fmt"
-
 	"gvisor.dev/gvisor/pkg/context"
 	"gvisor.dev/gvisor/pkg/errors/linuxerr"
 	"gvisor.dev/gvisor/pkg/refs"
@@ -128,27 +126,20 @@ func (vfs *VirtualFilesystem) NewMountNamespaceFrom(
 }
 
 // +checklocks:vfs.mountMu
-func (vfs *VirtualFilesystem) updateRootAndCWD(ctx context.Context, root *VirtualDentry, cwd *VirtualDentry, srcRoot *Mount, dstRoot *Mount) {
+func (vfs *VirtualFilesystem) updateRootAndCWD(ctx context.Context, root *VirtualDentry, cwd *VirtualDentry, src *Mount, dst *Mount) {
-	// The mount trees are exact copies of each other so submountsLocked will
+	if root.mount == src {
-	// return corresponding mounts in the same order.
+		vfs.delayDecRef(root.mount)
-	srcMounts := srcRoot.submountsLocked()
+		root.mount = dst
-	dstMounts := dstRoot.submountsLocked()
+		root.mount.IncRef()
-	if len(srcMounts) != len(dstMounts) {
-		panic(fmt.Sprintf("mount trees are not the same size: len(srcTree) = %d, len(dstTree) = %d", len(srcMounts), len(dstMounts)))
 	}
-	for i := 0; i < len(srcMounts); i++ {
+	if cwd.mount == src {
-		old := srcMounts[i]
+		vfs.delayDecRef(cwd.mount)
-		new := dstMounts[i]
+		cwd.mount = dst
-		if root.mount == old {
+		cwd.mount.IncRef()
-			vfs.delayDecRef(root.mount)
+	}
-			root.mount = new
+	for srcChild := range src.children {
-			root.mount.IncRef()
+		dstChild := vfs.mounts.Lookup(dst, srcChild.point())
-		}
+		vfs.updateRootAndCWD(ctx, root, cwd, srcChild, dstChild)
-		if cwd.mount == old {
-			vfs.delayDecRef(cwd.mount)
-			cwd.mount = new
-			cwd.mount.IncRef()
-		}
 	}
 }