Re: [PATCH v2 6/8] vfs: move open right after ->tmpfile()

[Al Viro <viro@zeniv.linux.org.uk>]

On Mon, Sep 19, 2022 at 04:10:29PM +0200, Miklos Szeredi wrote:

> -	child = d_alloc(dentry, &slash_name);
> +	child = d_alloc(parentpath->dentry, &slash_name);
>  	if (unlikely(!child))
>  		goto out_err;
> +	file->f_path.mnt = parentpath->mnt;
> +	file->f_path.dentry = child;
>  	mode = vfs_prepare_mode(mnt_userns, dir, mode, mode, mode);
>  	error = dir->i_op->tmpfile(mnt_userns, dir, child, mode);
> +	error = finish_open_simple(file, error);
> +	dput(child);
> +	if (error)
> +		goto out_err;
> +	error = may_open(mnt_userns, &file->f_path, 0, file->f_flags);
>  	if (error)
>  		goto out_err;
>  	error = -ENOENT;
>  	inode = child->d_inode;
>  	if (unlikely(!inode))
>  		goto out_err;

Ugh...  First of all, goto out_err leading to immediate return error;
is obfuscation for no good reason.  What's more, how the hell can
we get a negative dentry here?  The only thing that makes this check
valid is that after successful open child is pinned as file->f_path.dentry -
otherwise dput() above might have very well freed it.  And if we ever
end up with a negative dentry in file->f_path.dentry of an opened
file, we are really screwed...