mqueue: fix mq_open() file descriptor leak on user-space processes

We leak fd on lookup_one_len() failure

Signed-off-by: André Goddard Rosa <andre.goddard@gmail.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

1 files changed, 1 insertions, 2 deletions

diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index c79bd57353e7..04985a7256c2 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -705,7 +705,7 @@ SYSCALL_DEFINE4(mq_open, const char __user *, u_name, int, oflag, mode_t, mode,
         dentry = lookup_one_len(name, ipc_ns->mq_mnt->mnt_root, strlen(name));
         if (IS_ERR(dentry)) {
                 error = PTR_ERR(dentry);
-                goto out_err;
+                goto out_putfd;
         }
         mntget(ipc_ns->mq_mnt);
 
@@ -742,7 +742,6 @@ out:
         mntput(ipc_ns->mq_mnt);
 out_putfd:
         put_unused_fd(fd);
-out_err:
         fd = error;
 out_upsem:
         mutex_unlock(&ipc_ns->mq_mnt->mnt_root->d_inode->i_mutex);