path_openat(): fix double fput()

path_openat() jumps to the wrong place after do_tmpfile() - it has
already done path_cleanup() (as part of path_lookupat() called by
do_tmpfile()), so doing that again can lead to double fput().

Cc: stable@vger.kernel.org	# v3.11+
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
filename_mountpoint(int dfd, struct filename *name, struct path *path,
			unsigned int flags)
{
	int error;
	if (IS_ERR(name))
		return PTR_ERR(name);
	error = path_mountpoint(dfd, name, path, flags | LOOKUP_RCU);
	if (unlikely(error == -ECHILD))
		error = path_mountpoint(dfd, name, path, flags);
	if (unlikely(error == -ESTALE))
		error = path_mountpoint(dfd, name, path, flags | LOOKUP_REVAL);
	if (likely(!error))
		audit_inode(name, path->dentry, 0);
	putname(name);
	return error;
}

filename_mountpoint(int dfd, struct filename *name, struct path *path,
			unsigned int flags)
{
	int error;
	if (IS_ERR(name))
		return PTR_ERR(name);
	error = path_mountpoint(dfd, name, path, flags | LOOKUP_RCU);
	if (unlikely(error == -ECHILD))
		error = path_mountpoint(dfd, name, path, flags);
	if (unlikely(error == -ESTALE))
		error = path_mountpoint(dfd, name, path, flags | LOOKUP_REVAL);
	if (likely(!error))
		audit_inode(name, path->dentry, 0);
	putname(name);
	return error;
}
