linux/net/9p
Eric Van Hensbergen 1a3cac6c6d 9p: fix use after free
On 7/22/07, Adrian Bunk <bunk@stusta.de> wrote:
     The Coverity checker spotted the following use-after-free
     in net/9p/mux.c:

     <--  snip  -->

     ...
     struct p9_conn *p9_conn_create(struct p9_transport *trans, int msize,
                                         unsigned char *extended)
     {
     ...
             if (!m->tagpool) {
                     kfree(m);
                     return ERR_PTR(PTR_ERR(m->tagpool));
             }
     ...

     <--  snip  -->

Also spotted was a leak of the same structure further down in the function.

Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
2007-08-23 10:12:48 -05:00
..
client.c 9p: fix a race condition bug in umount which caused a segfault 2007-07-14 15:14:19 -05:00
conv.c fs: 9p/conv.c error path fix 2007-07-31 15:39:42 -07:00
error.c 9p: Reorganization of 9p file system code 2007-07-14 15:13:40 -05:00
fcprint.c 9p: Reorganization of 9p file system code 2007-07-14 15:13:40 -05:00
Kconfig 9p: Reorganization of 9p file system code 2007-07-14 15:13:40 -05:00
Makefile net/9p: change net/9p module name to 9pnet 2007-07-14 15:13:50 -05:00
mod.c 9p: Reorganization of 9p file system code 2007-07-14 15:13:40 -05:00
mux.c 9p: fix use after free 2007-08-23 10:12:48 -05:00
sysctl.c 9p: Don't use binary sysctl numbers. 2007-07-22 12:43:28 -07:00
trans_fd.c 9p: Reorganization of 9p file system code 2007-07-14 15:13:40 -05:00
util.c 9p: Reorganization of 9p file system code 2007-07-14 15:13:40 -05:00