Because inode is being initialised before checking if dentry is negative,
and the ihold() is only done if the dentry is *not* negative, the cleanup
code may end-up doing an extra iput() on that inode.
Fixes: b18825a7c8e3 ("VFS: Put a small type field into struct dentry::d_flags")
Signed-off-by: Luís Henriques <lhenriques@xxxxxxx>
---
Hi!
I was going to also remove the 'if (inode)' before the 'iput(inode)',
because 'iput()' already checks for NULL anyway. But since I probably
wouldn't have caught this bug if it wasn't for that 'if', I decided to
keep it there. But I can send v2 with that change too if you prefer.
Cheers,
--
Luís
fs/namei.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/fs/namei.c b/fs/namei.c
index 567ee547492b..156a570d7831 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -4386,11 +4386,9 @@ int do_unlinkat(int dfd, struct filename *name)
if (!IS_ERR(dentry)) {
/* Why not before? Because we want correct error value */
- if (last.name[last.len])
+ if (last.name[last.len] || d_is_negative(dentry))
goto slashes;
inode = dentry->d_inode;
- if (d_is_negative(dentry))
- goto slashes;
ihold(inode);
error = security_path_unlink(&path, dentry);
if (error)
