path.mnt in open_namei() set to mirror nd->mnt.
nd->mnt is set in 3 places in that function - path_lookup() in the beginning,
__follow_down() loop after do_last: and __do_follow_link() call after
do_link:.
We set path.mnt to nd->mnt after path_lookup() and __do_follow_link().  In
__follow_down() loop we use &path.mnt instead of &nd->mnt and set nd->mnt to
path.mnt immediately after that loop.
Obviously equivalent transformation.
Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
        nd->flags &= ~LOOKUP_PARENT;
        down(&dir->d_inode->i_sem);
        path.dentry = __lookup_hash(&nd->last, nd->dentry, nd);
+       path.mnt = nd->mnt;
 
 do_last:
        error = PTR_ERR(path.dentry);
                error = -ELOOP;
                if (flag & O_NOFOLLOW)
                        goto exit_dput;
-               while (__follow_down(&nd->mnt,&path.dentry) && d_mountpoint(path.dentry));
+               while (__follow_down(&path.mnt,&path.dentry) && d_mountpoint(path.dentry));
+               nd->mnt = path.mnt;
        }
        error = -ENOENT;
        if (!path.dentry->d_inode)
                goto exit_dput;
        error = __do_follow_link(path.dentry, nd);
        dput(path.dentry);
+       path.mnt = nd->mnt;
        if (error)
                return error;
        nd->flags &= ~LOOKUP_PARENT;