summaryrefslogtreecommitdiff
path: root/net/9p
diff options
context:
space:
mode:
authorEric Van Hensbergen <ericvh@ericvh-desktop.austin.ibm.com>2007-07-26 23:04:54 +0400
committerEric Van Hensbergen <ericvh@ericvh-laptop.austin.ibm.com>2007-08-23 19:12:48 +0400
commit1a3cac6c6d1f56dc26939eb41be29844f897c15a (patch)
tree02922961c01db29922737f37796265103e96dc6b /net/9p
parent8eb891fc809b2300137bcd247025628c06c95a63 (diff)
downloadlinux-1a3cac6c6d1f56dc26939eb41be29844f897c15a.tar.xz
9p: fix use after free
On 7/22/07, Adrian Bunk <bunk@stusta.de> wrote: The Coverity checker spotted the following use-after-free in net/9p/mux.c: <-- snip --> ... struct p9_conn *p9_conn_create(struct p9_transport *trans, int msize, unsigned char *extended) { ... if (!m->tagpool) { kfree(m); return ERR_PTR(PTR_ERR(m->tagpool)); } ... <-- snip --> Also spotted was a leak of the same structure further down in the function. Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
Diffstat (limited to 'net/9p')
-rw-r--r--net/9p/mux.c9
1 files changed, 6 insertions, 3 deletions
diff --git a/net/9p/mux.c b/net/9p/mux.c
index acb038810f39..5d70558c4c61 100644
--- a/net/9p/mux.c
+++ b/net/9p/mux.c
@@ -288,9 +288,10 @@ struct p9_conn *p9_conn_create(struct p9_transport *trans, int msize,
m->extended = extended;
m->trans = trans;
m->tagpool = p9_idpool_create();
- if (!m->tagpool) {
+ if (IS_ERR(m->tagpool)) {
+ mtmp = ERR_PTR(-ENOMEM);
kfree(m);
- return ERR_PTR(PTR_ERR(m->tagpool));
+ return mtmp;
}
m->err = 0;
@@ -308,8 +309,10 @@ struct p9_conn *p9_conn_create(struct p9_transport *trans, int msize,
memset(&m->poll_waddr, 0, sizeof(m->poll_waddr));
m->poll_task = NULL;
n = p9_mux_poll_start(m);
- if (n)
+ if (n) {
+ kfree(m);
return ERR_PTR(n);
+ }
n = trans->poll(trans, &m->pt);
if (n & POLLIN) {