[PATCH 4/9] fs: follow absolute symlinks from the root directory

[Sascha Hauer]

get_link() skips the leading slashes of an absolute symlink target, but
never moves the lookup to the root directory. The target is therefore
resolved relative to the directory containing the link:

  ln -s /tmp/a /tmp/b
  cat /tmp/b        -> looks up /tmp/tmp/a, fails with -ENOENT
  ln -s /a /tmp/z
  cat /tmp/z        -> opens /tmp/a

Do what Linux does in nd_jump_root() and replace the current path with
the root before continuing the walk. For lookups relative to an
O_CHROOT dirfd the root is the root of the dirfd's mount, so record the
root vfsmount along with the root dentry in struct nameidata.

Fixes: b3fbfad7ae ("fs: dentry cache implementation")
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Sascha Hauer <s.ha...@pengutronix.de>
---
 fs/fs.c | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/fs/fs.c b/fs/fs.c
index 1426ce4bc8..edb68cf455 100644
--- a/fs/fs.c
+++ b/fs/fs.c
@@ -1726,6 +1726,7 @@ struct nameidata {
        struct filename *name;
        struct inode    *link_inode;
        struct dentry   *d_root;
+       struct vfsmount *mnt_root;
 };
 
 struct filename {
@@ -1740,6 +1741,7 @@ static void set_nameidata(struct nameidata *p, struct 
filename *name)
        p->name = name;
        p->total_link_count = 0;
        p->d_root = d_root;
+       p->mnt_root = mnt_root;
 }
 
 static void path_get(const struct path *path)
@@ -2003,6 +2005,19 @@ static inline void path_to_nameidata(const struct path 
*path,
        nd->path.dentry = path->dentry;
 }
 
+static void nd_jump_root(struct nameidata *nd)
+{
+       struct path root = {
+               .mnt = nd->mnt_root,
+               .dentry = nd->d_root,
+       };
+
+       path_get(&root);
+       path_put(&nd->path);
+       nd->path = root;
+       nd->flags |= LOOKUP_JUMPED;
+}
+
 static const char *get_link(struct nameidata *nd)
 {
        struct saved *last = nd->stack + nd->depth - 1;
@@ -2018,6 +2033,7 @@ static const char *get_link(struct nameidata *nd)
                        return res;
        }
        if (*res == '/') {
+               nd_jump_root(nd);
                while (unlikely(*++res == '/'))
                        ;
        }
@@ -2323,8 +2339,10 @@ static const char *path_init(int dirfd, struct nameidata 
*nd, unsigned flags)
 
                if (*s == '/')
                        nd->path.dentry = nd->path.mnt->mnt_root;
-               if (chroot)
+               if (chroot) {
                        nd->d_root = nd->path.mnt->mnt_root;
+                       nd->mnt_root = nd->path.mnt;
+               }
        }
 
        return s;

-- 
2.47.3