The lockless traversals of the vfsmount lists are
dangerous and the use of referenceless vfsmounts may
lead to memory corruption. I've used lookup_mnt() using
the superblock root dentry and the struct vfsmount to
get a real, referenced vfsmount.
Note that the locking required does make use of a
non-exported symbol, one that was un-exported recently.
Since I am now making use of this symbol in an external
patch, I will ask for its re-export.
I have removed the dependency to find its own vfsmount,
since both ->lookup and ->open pass a vfsmount that can
be used to find the child mount. This allows things
like remount and multiple mount points.
I've rearranged some of the code so that prototypes
aren't required, and removed the subfs.h file since an
include file for 4 #defines is kind of silly.
A new subfs kernel patch.