Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f15133df authored by Al Viro's avatar Al Viro
Browse files

path_openat(): fix double fput() 



path_openat() jumps to the wrong place after do_tmpfile() - it has
already done path_cleanup() (as part of path_lookupat() called by
do_tmpfile()), so doing that again can lead to double fput().

Cc: stable@vger.kernel.org	# v3.11+
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent 766c4cbf

fs/namei.c

+2 −1
Original line number Original line Diff line number Diff line
@@ -3233,7 +3233,7 @@ static struct file *path_openat(int dfd, struct filename *pathname, 




	if (unlikely(file->f_flags & __O_TMPFILE)) {

	if (unlikely(file->f_flags & __O_TMPFILE)) {

		error = do_tmpfile(dfd, pathname, nd, flags, op, file, &opened);

		error = do_tmpfile(dfd, pathname, nd, flags, op, file, &opened);

		goto out;

		goto out2;

	}

	}





	error = path_init(dfd, pathname, flags, nd);

	error = path_init(dfd, pathname, flags, nd);
@@ -3263,6 +3263,7 @@ static struct file *path_openat(int dfd, struct filename *pathname, 
	}

	}

out:

out:

	path_cleanup(nd);

	path_cleanup(nd);

out2:

	if (!(opened & FILE_OPENED)) {

	if (!(opened & FILE_OPENED)) {

		BUG_ON(!error);

		BUG_ON(!error);

		put_filp(file);

		put_filp(file);