From: Al Viro path.mnt in open_namei() set to mirror nd->mnt. nd->mnt is set in 3 places in that function - path_lookup() in the beginning, __follow_down() loop after do_last: and __do_follow_link() call after do_link:. We set path.mnt to nd->mnt after path_lookup() and __do_follow_link(). In __follow_down() loop we use &path.mnt instead of &nd->mnt and set nd->mnt to path.mnt immediately after that loop. Obviously equivalent transformation. Signed-off-by: Al Viro Signed-off-by: Andrew Morton --- fs/namei.c | 5 ++++- 1 files changed, 4 insertions(+), 1 deletion(-) diff -puN fs/namei.c~namei-fixes-04-19 fs/namei.c --- 25/fs/namei.c~namei-fixes-04-19 Fri May 20 15:42:03 2005 +++ 25-akpm/fs/namei.c Fri May 20 15:42:03 2005 @@ -1442,6 +1442,7 @@ int open_namei(const char * pathname, in nd->flags &= ~LOOKUP_PARENT; down(&dir->d_inode->i_sem); path.dentry = __lookup_hash(&nd->last, nd->dentry, nd); + path.mnt = nd->mnt; do_last: error = PTR_ERR(path.dentry); @@ -1479,7 +1480,8 @@ do_last: error = -ELOOP; if (flag & O_NOFOLLOW) goto exit_dput; - while (__follow_down(&nd->mnt,&path.dentry) && d_mountpoint(path.dentry)); + while (__follow_down(&path.mnt,&path.dentry) && d_mountpoint(path.dentry)); + nd->mnt = path.mnt; } error = -ENOENT; if (!path.dentry->d_inode) @@ -1524,6 +1526,7 @@ do_link: goto exit_dput; error = __do_follow_link(path.dentry, nd); dput(path.dentry); + path.mnt = nd->mnt; if (error) return error; nd->flags &= ~LOOKUP_PARENT; _