summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAl Viro <viro@zeniv.linux.org.uk>2014-10-11 23:05:52 -0400
committerAl Viro <viro@zeniv.linux.org.uk>2014-10-12 17:09:04 -0400
commit115cbfdc609702a131c51281864c08f5d27b459a (patch)
tree14f486537d5897e9df9fdae73dd2844c5f181af2
parent24dff96a37a2ca319e75a74d3929b2de22447ca6 (diff)
downloadlinux-115cbfdc609702a131c51281864c08f5d27b459a.tar.bz2
let path_init() failures treated the same way as subsequent link_path_walk()
As it is, path_lookupat() and path_mounpoint() might end up leaking struct file reference in some cases. Spotted-by: Eric Biggers <ebiggers3@gmail.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
-rw-r--r--fs/namei.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/fs/namei.c b/fs/namei.c
index d20d579a022e..0f64aa412617 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -1950,7 +1950,7 @@ static int path_lookupat(int dfd, const char *name,
err = path_init(dfd, name, flags | LOOKUP_PARENT, nd, &base);
if (unlikely(err))
- return err;
+ goto out;
current->total_link_count = 0;
err = link_path_walk(name, nd);
@@ -1982,6 +1982,7 @@ static int path_lookupat(int dfd, const char *name,
}
}
+out:
if (base)
fput(base);
@@ -2301,7 +2302,7 @@ path_mountpoint(int dfd, const char *name, struct path *path, unsigned int flags
err = path_init(dfd, name, flags | LOOKUP_PARENT, &nd, &base);
if (unlikely(err))
- return err;
+ goto out;
current->total_link_count = 0;
err = link_path_walk(name, &nd);