Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs:
  9p: fix bad error path in conversion routines
  9p: remove deprecated v9fs_fid_lookup_remove()
  9p: update maintainers and documentation
  9p: fix use after free

2 files changed, 7 insertions, 3 deletions

diff --git a/net/9p/conv.c b/net/9p/conv.c
index f2a041cb508..d979d958ea1 100644
--- a/net/9p/conv.c
+++ b/net/9p/conv.c
@@ -796,6 +796,7 @@ struct p9_fcall *p9_create_twrite_u(u32 fid, u64 offset, u32 count,
         if (err) {
                 kfree(fc);
                 fc = ERR_PTR(err);
+                goto error;
         }
 
         if (buf_check_overflow(bufp)) {
diff --git a/net/9p/mux.c b/net/9p/mux.c
index acb038810f3..5d70558c4c6 100644
--- a/net/9p/mux.c
+++ b/net/9p/mux.c
@@ -288,9 +288,10 @@ struct p9_conn *p9_conn_create(struct p9_transport *trans, int msize,
         m->extended = extended;
         m->trans = trans;
         m->tagpool = p9_idpool_create();
-        if (!m->tagpool) {
+        if (IS_ERR(m->tagpool)) {
+                mtmp = ERR_PTR(-ENOMEM);
                 kfree(m);
-                return ERR_PTR(PTR_ERR(m->tagpool));
+                return mtmp;
         }
 
         m->err = 0;
@@ -308,8 +309,10 @@ struct p9_conn *p9_conn_create(struct p9_transport *trans, int msize,
         memset(&m->poll_waddr, 0, sizeof(m->poll_waddr));
         m->poll_task = NULL;
         n = p9_mux_poll_start(m);
-        if (n)
+        if (n) {
+                kfree(m);
                 return ERR_PTR(n);
+        }
 
         n = trans->poll(trans, &m->pt);
         if (n & POLLIN) {