path_openat(): fix double fput()

Al Viro · Al Viro · commit f15133df088e · 2015-05-09T00:12:48.000-04:00
path_openat() jumps to the wrong place after do_tmpfile() - it has
already done path_cleanup() (as part of path_lookupat() called by
do_tmpfile()), so doing that again can lead to double fput().

Cc: stable@vger.kernel.org	# v3.11+
Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
diff --git a/fs/namei.c b/fs/namei.c
@@ -3233,7 +3233,7 @@ static struct file *path_openat(int dfd, struct filename *pathname,
 
 	if (unlikely(file->f_flags & __O_TMPFILE)) {
 		error = do_tmpfile(dfd, pathname, nd, flags, op, file, &opened);
-		goto out;
+		goto out2;
 	}
 
 	error = path_init(dfd, pathname, flags, nd);
@@ -3263,6 +3263,7 @@ static struct file *path_openat(int dfd, struct filename *pathname,
 	}
 out:
 	path_cleanup(nd);
+out2:
 	if (!(opened & FILE_OPENED)) {
 		BUG_ON(!error);
 		put_filp(file);

Original file line number	Diff line number	Diff line change
`@@ -3233,7 +3233,7 @@ static struct file path_openat(int dfd, struct filename pathname,`
`3233`	`3233`
`3234`	`3234`	`if (unlikely(file->f_flags & __O_TMPFILE)) {`
`3235`	`3235`	`error = do_tmpfile(dfd, pathname, nd, flags, op, file, &opened);`
`3236`		`- goto out;`
	`3236`	`+ goto out2;`
`3237`	`3237`	`}`
`3238`	`3238`
`3239`	`3239`	`error = path_init(dfd, pathname, flags, nd);`
`@@ -3263,6 +3263,7 @@ static struct file path_openat(int dfd, struct filename pathname,`
`3263`	`3263`	`}`
`3264`	`3264`	`out:`
`3265`	`3265`	`path_cleanup(nd);`
	`3266`	`+out2:`
`3266`	`3267`	`if (!(opened & FILE_OPENED)) {`
`3267`	`3268`	`BUG_ON(!error);`
`3268`	`3269`	`put_filp(file);`