fix breakage in do_rmdir()

syzbot reported and bisected a use-after-free due to the recent init
cleanups.

The putname() should happen only after we'd *not* branched to retry,
same as it's done in do_unlinkat().

Reported-by: syzbot+bbeb1c88016c7db4aa24@syzkaller.appspotmail.com
Fixes: e24ab0ef689d "fs: push the getname from do_rmdir into the callers"
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/fs/namei.c b/fs/namei.c
index fde8fe086c090d8a4fe4b8c5ca7bb67d5ece3f77..9fa10c614de7d724658bc8db150f43366f250a84 100644 (file)
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -3770,11 +3770,11 @@ exit2:
        mnt_drop_write(path.mnt);
 exit1:
        path_put(&path);
-       putname(name);
        if (retry_estale(error, lookup_flags)) {
                lookup_flags |= LOOKUP_REVAL;
                goto retry;
        }
+       putname(name);
        return error;
 }