openat2: don't trigger automounts with RESOLVE_NO_XDEV

commit 042a60680de43175eb4df0977ff04a4eba9da082 upstream.

openat2 had a bug: if we pass RESOLVE_NO_XDEV, then openat2
doesn't traverse through automounts, but may still trigger them.
(See the link for full bug report with reproducer.)

This commit fixes this bug.

Link: https://lore.kernel.org/linux-fsdevel/20250817075252.4137628-1-safinaskar@zohomail.com/
Fixes: fddb5d430ad9fa91b49b1 ("open: introduce openat2(2) syscall")
Reviewed-by: Aleksa Sarai <cyphar@cyphar.com>
Cc: stable@vger.kernel.org
Signed-off-by: Askar Safin <safinaskar@zohomail.com>
Link: https://lore.kernel.org/20250825181233.2464822-5-safinaskar@zohomail.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/namei.c b/fs/namei.c
index 6795600c5738a56740bdeb2b4ec33f29545d918a..1eb20cb5e58f9e2251f7aba9c155387ff552858e 100644 (file)
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1388,6 +1388,10 @@ static int follow_automount(struct path *path, int *count, unsigned lookup_flags
            dentry->d_inode)
                return -EISDIR;
 
+       /* No need to trigger automounts if mountpoint crossing is disabled. */
+       if (lookup_flags & LOOKUP_NO_XDEV)
+               return -EXDEV;
+
        if (count && (*count)++ >= MAXSYMLINKS)
                return -ELOOP;
 
@@ -1411,6 +1415,10 @@ static int __traverse_mounts(struct path *path, unsigned flags, bool *jumped,
                /* Allow the filesystem to manage the transit without i_mutex
                 * being held. */
                if (flags & DCACHE_MANAGE_TRANSIT) {
+                       if (lookup_flags & LOOKUP_NO_XDEV) {
+                               ret = -EXDEV;
+                               break;
+                       }
                        ret = path->dentry->d_op->d_manage(path, false);
                        flags = smp_load_acquire(&path->dentry->d_flags);
                        if (ret < 0)