diff options
| author | Tejun Heo <tj@kernel.org> | 2008-10-13 18:45:20 -0500 |
|---|---|---|
| committer | Eric Van Hensbergen <ericvh@gmail.com> | 2008-10-17 11:04:42 -0500 |
| commit | 95820a36516d12dcb49d066dd3d5b187a2557612 (patch) | |
| tree | 84ba5869e9f68b3c943e75feb7c634da1c61f47a /net/9p/trans_fd.c | |
| parent | 91b8534fa8f5e01f249b1bf8df0a2540053549ad (diff) | |
| download | linux-stable-95820a36516d12dcb49d066dd3d5b187a2557612.tar.gz linux-stable-95820a36516d12dcb49d066dd3d5b187a2557612.tar.bz2 linux-stable-95820a36516d12dcb49d066dd3d5b187a2557612.zip | |
9p: drop broken unused error path from p9_conn_create()
Post p9_fd_poll() error path which checks m->poll_waddr[i] for PTR_ERR
value has the following problems.
* It's completely unused. Error value is set iff NULL @wait_address
has been specified to p9_pollwait() which is guaranteed not to
happen.
* It dereferences @m after deallocating it (introduced by 571ffeaf and
spotted by Raja R Harinath.
* It returned the wrong value on error. It should return
poll_waddr[i] but it returnes poll_waddr (introduced by 571ffeaf).
* p9_mux_poll_stop() doesn't handle PTR_ERR value. It will try to
operate on the PTR_ERR value as if it's a normal pointer and cause
oops.
As the error path is bogus in the first place, there's no reason to
hold onto it. Kill it.
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
Cc: Raja R Harinath <harinath@hurrynot.org>
Diffstat (limited to 'net/9p/trans_fd.c')
| -rw-r--r-- | net/9p/trans_fd.c | 17 |
1 files changed, 1 insertions, 16 deletions
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c index 6bfc013f8b6f..c07f2ab8d0f7 100644 --- a/net/9p/trans_fd.c +++ b/net/9p/trans_fd.c @@ -540,12 +540,6 @@ p9_pollwait(struct file *filp, wait_queue_head_t *wait_address, poll_table *p) return; } - if (!wait_address) { - P9_DPRINTK(P9_DEBUG_ERROR, "no wait_address\n"); - pwait->wait_addr = ERR_PTR(-EIO); - return; - } - pwait->conn = m; pwait->wait_addr = wait_address; init_waitqueue_func_entry(&pwait->wait, p9_pollwake); @@ -561,7 +555,7 @@ p9_pollwait(struct file *filp, wait_queue_head_t *wait_address, poll_table *p) static struct p9_conn *p9_conn_create(struct p9_client *client) { - int i, n; + int n; struct p9_conn *m; P9_DPRINTK(P9_DEBUG_MUX, "client %p msize %d\n", client, client->msize); @@ -590,15 +584,6 @@ static struct p9_conn *p9_conn_create(struct p9_client *client) set_bit(Wpending, &m->wsched); } - for (i = 0; i < ARRAY_SIZE(m->poll_wait); i++) { - if (IS_ERR(m->poll_wait[i].wait_addr)) { - p9_mux_poll_stop(m); - kfree(m); - /* return the error code */ - return (void *)m->poll_wait[i].wait_addr; - } - } - return m; } |