8 files changed, 55 insertions, 46 deletions

diff --git a/net/9p/client.c b/net/9p/client.c
index 8af95b2dddd6..09d4f1e2e4a8 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -69,7 +69,7 @@ p9_client_rpc(struct p9_client *c, int8_t type, const char *fmt, ...);
 
 static int parse_opts(char *opts, struct p9_client *clnt)
 {
-        char *options;
+        char *options, *tmp_options;
         char *p;
         substring_t args[MAX_OPT_ARGS];
         int option;
@@ -81,12 +81,13 @@ static int parse_opts(char *opts, struct p9_client *clnt)
         if (!opts)
                 return 0;
 
-        options = kstrdup(opts, GFP_KERNEL);
-        if (!options) {
+        tmp_options = kstrdup(opts, GFP_KERNEL);
+        if (!tmp_options) {
                 P9_DPRINTK(P9_DEBUG_ERROR,
                                 "failed to allocate copy of option string\n");
                 return -ENOMEM;
         }
+        options = tmp_options;
 
         while ((p = strsep(&options, ",")) != NULL) {
                 int token;
@@ -108,6 +109,13 @@ static int parse_opts(char *opts, struct p9_client *clnt)
                         break;
                 case Opt_trans:
                         clnt->trans_mod = v9fs_get_trans_by_name(&args[0]);
+                        if(clnt->trans_mod == NULL) {
+                                P9_DPRINTK(P9_DEBUG_ERROR,
+                                   "Could not find request transport: %s\n",
+                                   (char *) &args[0]);
+                                ret = -EINVAL;
+                                goto free_and_return;
+                        }
                         break;
                 case Opt_legacy:
                         clnt->dotu = 0;
@@ -117,7 +125,8 @@ static int parse_opts(char *opts, struct p9_client *clnt)
                 }
         }
 
-        kfree(options);
+free_and_return:
+        kfree(tmp_options);
         return ret;
 }
 
@@ -667,18 +676,12 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
         clnt->trans = NULL;
         spin_lock_init(&clnt->lock);
         INIT_LIST_HEAD(&clnt->fidlist);
-        clnt->fidpool = p9_idpool_create();
-        if (IS_ERR(clnt->fidpool)) {
-                err = PTR_ERR(clnt->fidpool);
-                clnt->fidpool = NULL;
-                goto error;
-        }
 
         p9_tag_init(clnt);
 
         err = parse_opts(options, clnt);
         if (err < 0)
-                goto error;
+                goto free_client;
 
         if (!clnt->trans_mod)
                 clnt->trans_mod = v9fs_get_default_trans();
@@ -687,7 +690,14 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
                 err = -EPROTONOSUPPORT;
                 P9_DPRINTK(P9_DEBUG_ERROR,
                                 "No transport defined or default transport\n");
-                goto error;
+                goto free_client;
+        }
+
+        clnt->fidpool = p9_idpool_create();
+        if (IS_ERR(clnt->fidpool)) {
+                err = PTR_ERR(clnt->fidpool);
+                clnt->fidpool = NULL;
+                goto put_trans;
         }
 
         P9_DPRINTK(P9_DEBUG_MUX, "clnt %p trans %p msize %d dotu %d\n",
@@ -695,19 +705,25 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
 
         err = clnt->trans_mod->create(clnt, dev_name, options);
         if (err)
-                goto error;
+                goto destroy_fidpool;
 
         if ((clnt->msize+P9_IOHDRSZ) > clnt->trans_mod->maxsize)
                 clnt->msize = clnt->trans_mod->maxsize-P9_IOHDRSZ;
 
         err = p9_client_version(clnt);
         if (err)
-                goto error;
+                goto close_trans;
 
         return clnt;
 
-error:
-        p9_client_destroy(clnt);
+close_trans:
+        clnt->trans_mod->close(clnt);
+destroy_fidpool:
+        p9_idpool_destroy(clnt->fidpool);
+put_trans:
+        v9fs_put_trans(clnt->trans_mod);
+free_client:
+        kfree(clnt);
         return ERR_PTR(err);
 }
 EXPORT_SYMBOL(p9_client_create);
@@ -1214,10 +1230,11 @@ static int p9_client_statsize(struct p9_wstat *wst, int optional)
 {
         int ret;
 
+        /* NOTE: size shouldn't include its own length */
         /* size[2] type[2] dev[4] qid[13] */
         /* mode[4] atime[4] mtime[4] length[8]*/
         /* name[s] uid[s] gid[s] muid[s] */
-        ret = 2+2+4+13+4+4+4+8+2+2+2+2;
+        ret = 2+4+13+4+4+4+8+2+2+2+2;
 
         if (wst->name)
                 ret += strlen(wst->name);
@@ -1258,7 +1275,7 @@ int p9_client_wstat(struct p9_fid *fid, struct p9_wstat *wst)
                 wst->name, wst->uid, wst->gid, wst->muid, wst->extension,
                 wst->n_uid, wst->n_gid, wst->n_muid);
 
-        req = p9_client_rpc(clnt, P9_TWSTAT, "dwS", fid->fid, wst->size, wst);
+        req = p9_client_rpc(clnt, P9_TWSTAT, "dwS", fid->fid, wst->size+2, wst);
         if (IS_ERR(req)) {
                 err = PTR_ERR(req);
                 goto error;
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index be1cb909d8c0..31d0b05582a9 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -714,7 +714,7 @@ static int parse_opts(char *params, struct p9_fd_opts *opts)
         char *p;
         substring_t args[MAX_OPT_ARGS];
         int option;
-        char *options;
+        char *options, *tmp_options;
         int ret;
 
         opts->port = P9_PORT;
@@ -724,12 +724,13 @@ static int parse_opts(char *params, struct p9_fd_opts *opts)
         if (!params)
                 return 0;
 
-        options = kstrdup(params, GFP_KERNEL);
-        if (!options) {
+        tmp_options = kstrdup(params, GFP_KERNEL);
+        if (!tmp_options) {
                 P9_DPRINTK(P9_DEBUG_ERROR,
                                 "failed to allocate copy of option string\n");
                 return -ENOMEM;
         }
+        options = tmp_options;
 
         while ((p = strsep(&options, ",")) != NULL) {
                 int token;
@@ -760,7 +761,8 @@ static int parse_opts(char *params, struct p9_fd_opts *opts)
                         continue;
                 }
         }
-        kfree(options);
+
+        kfree(tmp_options);
         return 0;
 }
 
diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c
index 65cb29db03f8..2c95a89c0f46 100644
--- a/net/9p/trans_rdma.c
+++ b/net/9p/trans_rdma.c
@@ -166,7 +166,7 @@ static int parse_opts(char *params, struct p9_rdma_opts *opts)
         char *p;
         substring_t args[MAX_OPT_ARGS];
         int option;
-        char *options;
+        char *options, *tmp_options;
         int ret;
 
         opts->port = P9_PORT;
@@ -177,12 +177,13 @@ static int parse_opts(char *params, struct p9_rdma_opts *opts)
         if (!params)
                 return 0;
 
-        options = kstrdup(params, GFP_KERNEL);
-        if (!options) {
+        tmp_options = kstrdup(params, GFP_KERNEL);
+        if (!tmp_options) {
                 P9_DPRINTK(P9_DEBUG_ERROR,
                            "failed to allocate copy of option string\n");
                 return -ENOMEM;
         }
+        options = tmp_options;
 
         while ((p = strsep(&options, ",")) != NULL) {
                 int token;
@@ -216,7 +217,7 @@ static int parse_opts(char *params, struct p9_rdma_opts *opts)
         }
         /* RQ must be at least as large as the SQ */
         opts->rq_depth = max(opts->rq_depth, opts->sq_depth);
-        kfree(options);
+        kfree(tmp_options);
         return 0;
 }
 
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index ea1e3daabefe..cb50f4ae5eef 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -102,7 +102,8 @@ static void p9_virtio_close(struct p9_client *client)
         struct virtio_chan *chan = client->trans;
 
         mutex_lock(&virtio_9p_lock);
-        chan->inuse = false;
+        if (chan)
+                chan->inuse = false;
         mutex_unlock(&virtio_9p_lock);
 }
 
@@ -311,6 +312,7 @@ p9_virtio_create(struct p9_client *client, const char *devname, char *args)
         }
 
         client->trans = (void *)chan;
+        client->status = Connected;
         chan->client = client;
 
         return 0;
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 82cae3bca78d..d08a0c7675bf 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -1280,6 +1280,7 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
         case ETHTOOL_GPERMADDR:
         case ETHTOOL_GUFO:
         case ETHTOOL_GGSO:
+        case ETHTOOL_GGRO:
         case ETHTOOL_GFLAGS:
         case ETHTOOL_GPFLAGS:
         case ETHTOOL_GRXFH:
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index b55a0c3df82f..83ed71500898 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -127,16 +127,12 @@ static int ipcomp4_init_state(struct xfrm_state *x)
         if (x->props.mode == XFRM_MODE_TUNNEL) {
                 err = ipcomp_tunnel_attach(x);
                 if (err)
-                        goto error_tunnel;
+                        goto out;
         }
 
         err = 0;
 out:
         return err;
-
-error_tunnel:
-        ipcomp_destroy(x);
-        goto out;
 }
 
 static const struct xfrm_type ipcomp_type = {
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index a9fbb151bb79..bb42f39c1db8 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -157,16 +157,12 @@ static int ipcomp6_init_state(struct xfrm_state *x)
         if (x->props.mode == XFRM_MODE_TUNNEL) {
                 err = ipcomp6_tunnel_attach(x);
                 if (err)
-                        goto error_tunnel;
+                        goto out;
         }
 
         err = 0;
 out:
         return err;
-error_tunnel:
-        ipcomp_destroy(x);
-
-        goto out;
 }
 
 static const struct xfrm_type ipcomp6_type =
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 96f2088e7448..9fa3322b2a7d 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1106,7 +1106,7 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
         int err = -ENOMEM;
         struct xfrm_state *x = xfrm_state_alloc(net);
         if (!x)
-                goto error;
+                goto out;
 
         memcpy(&x->id, &orig->id, sizeof(x->id));
         memcpy(&x->sel, &orig->sel, sizeof(x->sel));
@@ -1164,16 +1164,10 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, int *errp)
         return x;
 
  error:
+        xfrm_state_put(x);
+out:
         if (errp)
                 *errp = err;
-        if (x) {
-                kfree(x->aalg);
-                kfree(x->ealg);
-                kfree(x->calg);
-                kfree(x->encap);
-                kfree(x->coaddr);
-        }
-        kfree(x);
         return NULL;
 }