path_openat() jumps to the wrong place after do_tmpfile() - it has already done path_cleanup() (as part of path_lookupat() called by do_tmpfile()), so doing that again can lead to double fput().
Unified · Split
| @@ -3233,7 +3233,7 @@ static struct file *path_openat(int dfd, struct filename *pathname, · 3232 unmodified lines | ||
| 3233 | 3233 | |
| 3234 | 3234 | if (unlikely(file->f_flags & __O_TMPFILE)) { |
| 3235 | 3235 | error = do_tmpfile(dfd, pathname, nd, flags, op, file, &opened); |
| 3236 | − goto out; | |
| 3236 | + goto out2; | |
| 3237 | 3237 | } |
| 3238 | 3238 | |
| 3239 | 3239 | error = path_init(dfd, pathname, flags, nd); |
| @@ -3263,6 +3263,7 @@ static struct file *path_openat(int dfd, struct filename *pathname, · 23 unmodified lines | ||
| 3263 | 3263 | } |
| 3264 | 3264 | out: |
| 3265 | 3265 | path_cleanup(nd); |
| 3266 | +out2: | |
| 3266 | 3267 | if (!(opened & FILE_OPENED)) { |
| 3267 | 3268 | BUG_ON(!error); |
| 3268 | 3269 | put_filp(file); |