adulau/aha
1
0
Fork 0
mirror of https://github.com/adulau/aha.git synced 2024-12-28 03:36:19 +00:00
Code Issues Projects Releases Packages Wiki Activity

9p: drop broken unused error path from p9_conn_create()

Browse source 
Post p9_fd_poll() error path which checks m->poll_waddr[i] for PTR_ERR
value has the following problems.

* It's completely unused.  Error value is set iff NULL @wait_address
  has been specified to p9_pollwait() which is guaranteed not to
  happen.

* It dereferences @m after deallocating it (introduced by 571ffeaf and
  spotted by Raja R Harinath.

* It returned the wrong value on error.  It should return
  poll_waddr[i] but it returnes poll_waddr (introduced by 571ffeaf).

* p9_mux_poll_stop() doesn't handle PTR_ERR value.  It will try to
  operate on the PTR_ERR value as if it's a normal pointer and cause
  oops.

As the error path is bogus in the first place, there's no reason to
hold onto it.  Kill it.

Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>
Cc: Raja R Harinath <harinath@hurrynot.org>
This commit is contained in:
Tejun Heo 2008-10-13 18:45:20 -05:00 committed by Eric Van Hensbergen
parent 91b8534fa8
commit 95820a3651
1 changed files with 1 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
net/9p/trans_fd.c
View file

@ -540,12 +540,6 @@ p9_pollwait(struct file *filp, wait_queue_head_t *wait_address, poll_table *p)
return;
}
if (!wait_address) {
P9_DPRINTK(P9_DEBUG_ERROR, "no wait_address\n");
pwait->wait_addr = ERR_PTR(-EIO);
return;
}
pwait->conn = m;
pwait->wait_addr = wait_address;
init_waitqueue_func_entry(&pwait->wait, p9_pollwake);
@ -561,7 +555,7 @@ p9_pollwait(struct file *filp, wait_queue_head_t *wait_address, poll_table *p)
static struct p9_conn *p9_conn_create(struct p9_client *client)
{
int i, n;
int n;
struct p9_conn *m;
P9_DPRINTK(P9_DEBUG_MUX, "client %p msize %d\n", client, client->msize);
@ -590,15 +584,6 @@ static struct p9_conn *p9_conn_create(struct p9_client *client)
set_bit(Wpending, &m->wsched);
}
for (i = 0; i < ARRAY_SIZE(m->poll_wait); i++) {
if (IS_ERR(m->poll_wait[i].wait_addr)) {
p9_mux_poll_stop(m);
kfree(m);
/* return the error code */
return (void *)m->poll_wait[i].wait_addr;
}
}
return m;
}