fix: cleanup tempfiles when error prevents calling link

When a client provides an invalid or incomplete body for a single-part
upload, the handler returns before the link stage.  Factor tempfile
removal into cleanup() to catch all cases.

backend/posix/with_otmpfile.go

@@ -25,6 +25,7 @@ import (
 	"os"
 	"path/filepath"
 	"strconv"
+	"strings"
 	"syscall"
 	"time"
 
@@ -230,9 +231,6 @@ func (tmp *tmpfile) link() error {
 
 func (tmp *tmpfile) fallbackLink() error {
 	tempname := tmp.f.Name()
-	// cleanup in case anything goes wrong, if rename succeeds then
-	// this will no longer exist
-	defer os.Remove(tempname)
 
 	// reset default file mode because CreateTemp uses 0600
 	tmp.f.Chmod(fs.FileMode(defaultFilePerm))
@@ -265,6 +263,9 @@ func (tmp *tmpfile) Write(b []byte) (int, error) {
 
 func (tmp *tmpfile) cleanup() {
 	tmp.f.Close()
+	if !strings.HasPrefix(tmp.f.Name(), procfddir) {
+		os.Remove(tmp.f.Name())
+	}
 }
 
 func (tmp *tmpfile) File() *os.File {

backend/posix/without_otmpfile.go

@@ -75,9 +75,6 @@ var (
 
 func (tmp *tmpfile) link() error {
 	tempname := tmp.f.Name()
-	// cleanup in case anything goes wrong, if rename succeeds then
-	// this will no longer exist
-	defer os.Remove(tempname)
 
 	objPath := filepath.Join(tmp.bucket, tmp.objname)
 
@@ -104,6 +101,7 @@ func (tmp *tmpfile) Write(b []byte) (int, error) {
 
 func (tmp *tmpfile) cleanup() {
 	tmp.f.Close()
+	os.Remove(tmp.f.Name())
 }
 
 func (tmp *tmpfile) File() *os.File {