diff options
| author |   Al Viro <viro@zeniv.linux.org.uk> | 2014-10-11 23:05:52 -0400 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2014-10-12 17:09:04 -0400 |
| commit | 115cbfdc609702a131c51281864c08f5d27b459a (patch) | |
| tree | 14f486537d5897e9df9fdae73dd2844c5f181af2 | |
| parent | fix misuses of f_count() in ppp and netlink (diff) | |
| download | linux-dev-115cbfdc609702a131c51281864c08f5d27b459a.tar.xz linux-dev-115cbfdc609702a131c51281864c08f5d27b459a.zip | |
let path_init() failures treated the same way as subsequent link_path_walk()
As it is, path_lookupat() and path_mounpoint() might end up leaking struct file
reference in some cases.
Spotted-by: Eric Biggers <ebiggers3@gmail.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
| -rw-r--r-- | fs/namei.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/fs/namei.c b/fs/namei.c index d20d579a022e..0f64aa412617 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -1950,7 +1950,7 @@ static int path_lookupat(int dfd, const char *name, err = path_init(dfd, name, flags | LOOKUP_PARENT, nd, &base); if (unlikely(err)) - return err; + goto out; current->total_link_count = 0; err = link_path_walk(name, nd); @@ -1982,6 +1982,7 @@ static int path_lookupat(int dfd, const char *name, } } +out: if (base) fput(base); @@ -2301,7 +2302,7 @@ path_mountpoint(int dfd, const char *name, struct path *path, unsigned int flags err = path_init(dfd, name, flags | LOOKUP_PARENT, &nd, &base); if (unlikely(err)) - return err; + goto out; current->total_link_count = 0; err = link_path_walk(name, &nd); |