path_openat() jumps to the wrong place after do_tmpfile() - it has already done path_cleanup() (as part of path_lookupat() called by do_tmpfile()), so doing that again can lead to double fput().
Unified · Split
| @@ -3233,7 +3233,7 @@ static struct file *path_openat(int dfd, struct filename *pathname, · 3232 unmodified lines | |||
| 3233 | 3233 | ||
| 3234 | if (unlikely(file->f_flags & __O_TMPFILE)) { | 3234 | if (unlikely(file->f_flags & __O_TMPFILE)) { |
| 3235 | error = do_tmpfile(dfd, pathname, nd, flags, op, file, &opened); | 3235 | error = do_tmpfile(dfd, pathname, nd, flags, op, file, &opened); |
| 3236 | goto out; | 3236 | goto out2; |
| 3237 | } | 3237 | } |
| 3238 | 3238 | ||
| 3239 | error = path_init(dfd, pathname, flags, nd); | 3239 | error = path_init(dfd, pathname, flags, nd); |
| @@ -3263,6 +3263,7 @@ static struct file *path_openat(int dfd, struct filename *pathname, · 23 unmodified lines | |||
| 3263 | } | 3263 | } |
| 3264 | out: | 3264 | out: |
| 3265 | path_cleanup(nd); | 3265 | path_cleanup(nd); |
| 3266 | out2: | ||
| 3266 | if (!(opened & FILE_OPENED)) { | 3267 | if (!(opened & FILE_OPENED)) { |
| 3267 | BUG_ON(!error); | 3268 | BUG_ON(!error); |
| 3268 | put_filp(file); | 3269 | put_filp(file); |