Check for invalid trailing / when traversing path in gofer OpenAt.

Updates #2923.

PiperOrigin-RevId: 317700049

pkg/sentry/fsimpl/gofer/filesystem.go

@@ -767,15 +767,17 @@ afterTrailingSymlink:
 		parent.dirMu.Unlock()
 		return fd, err
 	}
+	parent.dirMu.Unlock()
 	if err != nil {
-		parent.dirMu.Unlock()
 		return nil, err
 	}
-	// Open existing child or follow symlink.
-	parent.dirMu.Unlock()
 	if mustCreate {
 		return nil, syserror.EEXIST
 	}
+	if !child.isDir() && rp.MustBeDir() {
+		return nil, syserror.ENOTDIR
+	}
+	// Open existing child or follow symlink.
 	if child.isSymlink() && rp.ShouldFollowSymlink() {
 		target, err := child.readlink(ctx, rp.Mount())
 		if err != nil {

test/syscalls/BUILD

@@ -181,6 +181,7 @@ syscall_test(
     size = "medium",
     add_overlay = True,
     test = "//test/syscalls/linux:exec_binary_test",
+    vfs2 = "True",
 )
 
 syscall_test(

test/syscalls/linux/open.cc

@@ -439,6 +439,12 @@ TEST_F(OpenTest, CanTruncateWithStrangePermissions) {
   EXPECT_THAT(close(fd), SyscallSucceeds());
 }
 
+TEST_F(OpenTest, OpenNonDirectoryWithTrailingSlash) {
+  const TempPath file = ASSERT_NO_ERRNO_AND_VALUE(TempPath::CreateFile());
+  const std::string bad_path = file.path() + "/";
+  EXPECT_THAT(open(bad_path.c_str(), O_RDONLY), SyscallFailsWithErrno(ENOTDIR));
+}
+
 }  // namespace
 
 }  // namespace testing