1. 24 10月, 2007 1 次提交
  2. 18 10月, 2007 2 次提交
  3. 23 8月, 2007 1 次提交
    • E
      9p: fix use after free · 1a3cac6c
      Eric Van Hensbergen 提交于
      On 7/22/07, Adrian Bunk <bunk@stusta.de> wrote:
           The Coverity checker spotted the following use-after-free
           in net/9p/mux.c:
      
           <--  snip  -->
      
           ...
           struct p9_conn *p9_conn_create(struct p9_transport *trans, int msize,
                                               unsigned char *extended)
           {
           ...
                   if (!m->tagpool) {
                           kfree(m);
                           return ERR_PTR(PTR_ERR(m->tagpool));
                   }
           ...
      
           <--  snip  -->
      
      Also spotted was a leak of the same structure further down in the function.
      Signed-off-by: NEric Van Hensbergen <ericvh@gmail.com>
      1a3cac6c
  4. 15 7月, 2007 2 次提交
  5. 19 2月, 2007 1 次提交
  6. 27 1月, 2007 1 次提交
  7. 22 11月, 2006 1 次提交
  8. 01 7月, 2006 1 次提交
  9. 29 6月, 2006 1 次提交
  10. 27 6月, 2006 1 次提交
  11. 16 5月, 2006 1 次提交
  12. 26 3月, 2006 3 次提交
  13. 24 3月, 2006 1 次提交
  14. 23 3月, 2006 1 次提交
  15. 04 2月, 2006 1 次提交
    • L
      [PATCH] v9fs: fix corner cases when flushing request · 034b91a3
      Latchesar Ionkov 提交于
      When v9fs_mux_rpc sends a 9P message, it may be put in the queue of unsent
      request.  If the user process receives a signal, v9fs_mux_rpc sets the
      request error to ERREQFLUSH and assigns NULL to request's send message.  If
      the message was still in the unsent queue, v9fs_write_work would produce an
      oops while processing it.
      
      The patch makes sure that requests that are being flushed are moved to the
      pending requests queue safely.
      
      If a request is being flushed, don't remove it from the list of pending
      requests even if it receives a reply before the flush is acknoledged.  The
      request will be removed during from the Rflush handler (v9fs_mux_flush_cb).
      Signed-off-by: NLatchesar Ionkov <lucho@ionkov.net>
      Cc: Eric Van Hensbergen <ericvh@ericvh.myip.org>
      Signed-off-by: NAndrew Morton <akpm@osdl.org>
      Signed-off-by: NLinus Torvalds <torvalds@osdl.org>
      034b91a3
  16. 09 1月, 2006 3 次提交
  17. 10 9月, 2005 3 次提交