1 files changed, 8 insertions, 1 deletions

diff --git a/fs/namei.c b/fs/namei.c
index 0223c41fb114..14ab8d3f2f0c 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -433,6 +433,8 @@ static int unlazy_walk(struct nameidata *nd, struct dentry *dentry)
                         goto err_parent;
                 BUG_ON(nd->inode != parent->d_inode);
         } else {
+                if (dentry->d_parent != parent)
+                        goto err_parent;
                 spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
                 if (!__d_rcu_to_refcount(dentry, nd->seq))
                         goto err_child;
@@ -940,7 +942,6 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
                  * Don't forget we might have a non-mountpoint managed dentry
                  * that wants to block transit.
                  */
-                *inode = path->dentry->d_inode;
                 if (unlikely(managed_dentry_might_block(path->dentry)))
                         return false;
 
@@ -953,6 +954,12 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
                 path->mnt = mounted;
                 path->dentry = mounted->mnt_root;
                 nd->seq = read_seqcount_begin(&path->dentry->d_seq);
+                /*
+                 * Update the inode too. We don't need to re-check the
+                 * dentry sequence number here after this d_inode read,
+                 * because a mount-point is always pinned.
+                 */
+                *inode = path->dentry->d_inode;
         }
         return true;
 }