[PATCH 5.10/6.1/6.12] mount: honour SB_NOUSER in the new mount API

[Denis Arefev]

From: Al Viro <viro@xxxxxxxxxxxxxxxxxx>

commit 6dd3c6884cd9defb511284b566cef5ac8f657dbf upstream.

One should *not* be allowed to mount one of those, new API or not.

Reported-by: Denis Arefev <arefev@xxxxxxxxx>
Signed-off-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
Link: https://patch.msgid.link/20260602020444.GP2636677@ZenIV
Signed-off-by: Christian Brauner (Amutable) <brauner@xxxxxxxxxx>
[Denis: rename new_mnt -> newmount.mnt]
[Denis: use goto err_unlock instead of direct return]
Signed-off-by: Denis Arefev <arefev@xxxxxxxxx>
---
 fs/namespace.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/fs/namespace.c b/fs/namespace.c
index 94c06c842902..a596381dba1c 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -4229,6 +4229,11 @@ SYSCALL_DEFINE3(fsmount, int, fs_fd, unsigned int, flags,
 		ret = PTR_ERR(newmount.mnt);
 		goto err_unlock;
 	}
+	if (newmount.mnt->mnt_sb->s_flags & SB_NOUSER) {
+		mntput(newmount.mnt);
+		ret = -EINVAL;
+		goto err_unlock;
+	}
 	newmount.dentry = dget(fc->root);
 	newmount.mnt->mnt_flags = mnt_flags;
 
-- 
2.43.0