Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
Pull vfs fixes from Al Viro:
"A couple of fixes for bugs caught while digging in fs/namei.c. The
first one is this cycle regression, the second is 3.11 and later"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
path_openat(): fix double fput()
namei: d_is_negative() should be checked before ->d_seq validation
+15
-7
+15
-7
fs/namei.c
+15
-7
fs/namei.c
···
1415
1415
*/
1416
1416
if (nd->flags & LOOKUP_RCU) {
1417
1417
unsigned seq;
1418
+
bool negative;
1418
1419
dentry = __d_lookup_rcu(parent, &nd->last, &seq);
1419
1420
if (!dentry)
1420
1421
goto unlazy;
···
1425
1424
* the dentry name information from lookup.
1426
1425
*/
1427
1426
*inode = dentry->d_inode;
1427
+
negative = d_is_negative(dentry);
1428
1428
if (read_seqcount_retry(&dentry->d_seq, seq))
1429
1429
return -ECHILD;
1430
+
if (negative)
1431
+
return -ENOENT;
1430
1432
1431
1433
/*
1432
1434
* This sequence count validates that the parent had no
···
1476
1472
goto need_lookup;
1477
1473
}
1478
1474
1475
+
if (unlikely(d_is_negative(dentry))) {
1476
+
dput(dentry);
1477
+
return -ENOENT;
1478
+
}
1479
1479
path->mnt = mnt;
1480
1480
path->dentry = dentry;
1481
1481
err = follow_managed(path, nd->flags);
···
1591
1583
goto out_err;
1592
1584
1593
1585
inode = path->dentry->d_inode;
1586
+
err = -ENOENT;
1587
+
if (d_is_negative(path->dentry))
1588
+
goto out_path_put;
1594
1589
}
1595
-
err = -ENOENT;
1596
-
if (d_is_negative(path->dentry))
1597
-
goto out_path_put;
1598
1590
1599
1591
if (should_follow_link(path->dentry, follow)) {
1600
1592
if (nd->flags & LOOKUP_RCU) {
···
3044
3036
3045
3037
BUG_ON(nd->flags & LOOKUP_RCU);
3046
3038
inode = path->dentry->d_inode;
3047
-
finish_lookup:
3048
-
/* we _can_ be in RCU mode here */
3049
3039
error = -ENOENT;
3050
3040
if (d_is_negative(path->dentry)) {
3051
3041
path_to_nameidata(path, nd);
3052
3042
goto out;
3053
3043
}
3054
-
3044
+
finish_lookup:
3045
+
/* we _can_ be in RCU mode here */
3055
3046
if (should_follow_link(path->dentry, !symlink_ok)) {
3056
3047
if (nd->flags & LOOKUP_RCU) {
3057
3048
if (unlikely(nd->path.mnt != path->mnt ||
···
3233
3226
3234
3227
if (unlikely(file->f_flags & __O_TMPFILE)) {
3235
3228
error = do_tmpfile(dfd, pathname, nd, flags, op, file, &opened);
3236
-
goto out;
3229
+
goto out2;
3237
3230
}
3238
3231
3239
3232
error = path_init(dfd, pathname, flags, nd);
···
3263
3256
}
3264
3257
out:
3265
3258
path_cleanup(nd);
3259
+
out2:
3266
3260
if (!(opened & FILE_OPENED)) {
3267
3261
BUG_ON(!error);
3268
3262
put_filp(file);