[PATCH 4/9] fs: follow absolute symlinks from the root directory

[Sascha Hauer <s.hauer@pengutronix.de>]

get_link() skips the leading slashes of an absolute symlink target, but
never moves the lookup to the root directory. The target is therefore
resolved relative to the directory containing the link:

  ln -s /tmp/a /tmp/b
  cat /tmp/b        -> looks up /tmp/tmp/a, fails with -ENOENT
  ln -s /a /tmp/z
  cat /tmp/z        -> opens /tmp/a

Do what Linux does in nd_jump_root() and replace the current path with
the root before continuing the walk. For lookups relative to an
O_CHROOT dirfd the root is the root of the dirfd's mount, so record the
root vfsmount along with the root dentry in struct nameidata.

Fixes: b3fbfad7ae ("fs: dentry cache implementation")
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 fs/fs.c | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/fs/fs.c b/fs/fs.c
index 1426ce4bc8..edb68cf455 100644
--- a/fs/fs.c
+++ b/fs/fs.c
@@ -1726,6 +1726,7 @@ struct nameidata {
 	struct filename	*name;
 	struct inode	*link_inode;
 	struct dentry   *d_root;
+	struct vfsmount *mnt_root;
 };
 
 struct filename {
@@ -1740,6 +1741,7 @@ static void set_nameidata(struct nameidata *p, struct filename *name)
 	p->name = name;
 	p->total_link_count = 0;
 	p->d_root = d_root;
+	p->mnt_root = mnt_root;
 }
 
 static void path_get(const struct path *path)
@@ -2003,6 +2005,19 @@ static inline void path_to_nameidata(const struct path *path,
 	nd->path.dentry = path->dentry;
 }
 
+static void nd_jump_root(struct nameidata *nd)
+{
+	struct path root = {
+		.mnt = nd->mnt_root,
+		.dentry = nd->d_root,
+	};
+
+	path_get(&root);
+	path_put(&nd->path);
+	nd->path = root;
+	nd->flags |= LOOKUP_JUMPED;
+}
+
 static const char *get_link(struct nameidata *nd)
 {
 	struct saved *last = nd->stack + nd->depth - 1;
@@ -2018,6 +2033,7 @@ static const char *get_link(struct nameidata *nd)
 			return res;
 	}
 	if (*res == '/') {
+		nd_jump_root(nd);
 		while (unlikely(*++res == '/'))
 			;
 	}
@@ -2323,8 +2339,10 @@ static const char *path_init(int dirfd, struct nameidata *nd, unsigned flags)
 
 		if (*s == '/')
 			nd->path.dentry = nd->path.mnt->mnt_root;
-		if (chroot)
+		if (chroot) {
 			nd->d_root = nd->path.mnt->mnt_root;
+			nd->mnt_root = nd->path.mnt;
+		}
 	}
 
 	return s;

-- 
2.47.3