GIT a85e4c1fefdc0aed7833104f380c49122b0f96fc git+ssh://master.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs.git#v9fs-devel commit Author: Eric Van Hensbergen Date: Wed Jul 25 14:54:58 2007 -0500 9p: fix use-after-free in mux On 7/22/07, Adrian Bunk wrote: The Coverity checker spotted the following use-after-free in net/9p/mux.c: <-- snip --> ... struct p9_conn *p9_conn_create(struct p9_transport *trans, int msize, unsigned char *extended) { ... if (!m->tagpool) { kfree(m); return ERR_PTR(PTR_ERR(m->tagpool)); } ... <-- snip --> Also spotted was a leak of the same structure further down in the function. Signed-off-by: Eric Van Hensbergen commit fa3c4863f2f978ae648bd10d00f096a0f16fe944 Author: Eric Van Hensbergen Date: Mon Jul 23 13:06:13 2007 -0500 9p: update maintainers and documentation Updates to the MAINTAINERS file and documentation for 9p to point to the swik wiki versus the outdated sf.net page. Also updated some email addresses and added pointers to papers which better describe the implementation and application of the Linux 9p client. Signed-off-by: Eric Van Hensbergen Documentation/filesystems/9p.txt | 24 +++++++++++++++++++----- MAINTAINERS | 4 ++-- net/9p/mux.c | 7 +++++-- 3 files changed, 26 insertions(+), 9 deletions(-) diff --git a/Documentation/filesystems/9p.txt b/Documentation/filesystems/9p.txt index bbd8b28..2035fdc 100644 --- a/Documentation/filesystems/9p.txt +++ b/Documentation/filesystems/9p.txt @@ -6,12 +6,26 @@ ABOUT v9fs is a Unix implementation of the Plan 9 9p remote filesystem protocol. -This software was originally developed by Ron Minnich -and Maya Gokhale . Additional development by Greg Watson +This software was originally developed by Ron Minnich +and Maya Gokhale. Additional development by Greg Watson and most recently Eric Van Hensbergen , Latchesar Ionkov and Russ Cox . +The best detailed explanation of the Linux implementation and applications of +the 9p client is available in the form of a USENIX paper: + http://www.usenix.org/events/usenix05/tech/freenix/hensbergen.html + +Other applications are described in the following papers: + * XCPU & Clustering + http://www.xcpu.org/xcpu-talk.pdf + * KVMFS: control file system for KVM + http://www.xcpu.org/kvmfs.pdf + * CellFS: A New ProgrammingModel for the Cell BE + http://www.xcpu.org/cellfs-talk.pdf + * PROSE I/O: Using 9p to enable Application Partitions + http://plan9.escet.urjc.es/iwp9/cready/PROSE_iwp9_2006.pdf + USAGE ===== @@ -90,9 +104,9 @@ subset of the namespace by extending the and export. A Linux version of the 9p server is now maintained under the npfs project -on sourceforge (http://sourceforge.net/projects/npfs). There is also a -more stable single-threaded version of the server (named spfs) available from -the same CVS repository. +on sourceforge (http://sourceforge.net/projects/npfs). The currently +maintained version is the single-threaded version of the server (named spfs) +available from the same CVS repository. There are user and developer mailing lists available through the v9fs project on sourceforge (http://sourceforge.net/projects/v9fs). diff --git a/MAINTAINERS b/MAINTAINERS index c292897..1bb88af 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -161,11 +161,11 @@ S: Maintained P: Eric Van Hensbergen M: ericvh@gmail.com P: Ron Minnich -M: rminnich@lanl.gov +M: rminnich@sandia.gov P: Latchesar Ionkov M: lucho@ionkov.net L: v9fs-developer@lists.sourceforge.net -W: http://v9fs.sf.net +W: http://swik.net/v9fs T: git kernel.org:/pub/scm/linux/kernel/ericvh/v9fs.git S: Maintained diff --git a/net/9p/mux.c b/net/9p/mux.c index acb0388..dfc83f6 100644 --- a/net/9p/mux.c +++ b/net/9p/mux.c @@ -289,8 +289,9 @@ struct p9_conn *p9_conn_create(struct p9 m->trans = trans; m->tagpool = p9_idpool_create(); if (!m->tagpool) { + mtmp = ERR_PTR(PTR_ERR(m->tagpool)); kfree(m); - return ERR_PTR(PTR_ERR(m->tagpool)); + return mtmp; } m->err = 0; @@ -308,8 +309,10 @@ struct p9_conn *p9_conn_create(struct p9 memset(&m->poll_waddr, 0, sizeof(m->poll_waddr)); m->poll_task = NULL; n = p9_mux_poll_start(m); - if (n) + if (n) { + kfree(m); return ERR_PTR(n); + } n = trans->poll(trans, &m->pt); if (n & POLLIN) {