Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs:
  9p: fix bad error path in conversion routines
  9p: remove deprecated v9fs_fid_lookup_remove()
  9p: update maintainers and documentation
  9p: fix use after free
diff --git a/Documentation/filesystems/9p.txt b/Documentation/filesystems/9p.txt
index bbd8b28..cda6905c 100644
--- a/Documentation/filesystems/9p.txt
+++ b/Documentation/filesystems/9p.txt
@@ -6,12 +6,26 @@
 
 v9fs is a Unix implementation of the Plan 9 9p remote filesystem protocol.
 
-This software was originally developed by Ron Minnich <rminnich@lanl.gov>
-and Maya Gokhale <maya@lanl.gov>.  Additional development by Greg Watson
+This software was originally developed by Ron Minnich <rminnich@sandia.gov>
+and Maya Gokhale.  Additional development by Greg Watson
 <gwatson@lanl.gov> and most recently Eric Van Hensbergen
 <ericvh@gmail.com>, Latchesar Ionkov <lucho@ionkov.net> and Russ Cox
 <rsc@swtch.com>.
 
+The best detailed explanation of the Linux implementation and applications of
+the 9p client is available in the form of a USENIX paper:
+   http://www.usenix.org/events/usenix05/tech/freenix/hensbergen.html
+
+Other applications are described in the following papers:
+	* XCPU & Clustering
+		http://www.xcpu.org/xcpu-talk.pdf
+	* KVMFS: control file system for KVM
+		http://www.xcpu.org/kvmfs.pdf
+	* CellFS: A New ProgrammingModel for the Cell BE
+		http://www.xcpu.org/cellfs-talk.pdf
+	* PROSE I/O: Using 9p to enable Application Partitions
+		http://plan9.escet.urjc.es/iwp9/cready/PROSE_iwp9_2006.pdf
+
 USAGE
 =====
 
@@ -90,9 +104,9 @@
 and export.
 
 A Linux version of the 9p server is now maintained under the npfs project
-on sourceforge (http://sourceforge.net/projects/npfs).  There is also a
-more stable single-threaded version of the server (named spfs) available from
-the same CVS repository.
+on sourceforge (http://sourceforge.net/projects/npfs).  The currently
+maintained version is the single-threaded version of the server (named spfs)
+available from the same CVS repository.
 
 There are user and developer mailing lists available through the v9fs project
 on sourceforge (http://sourceforge.net/projects/v9fs).
diff --git a/MAINTAINERS b/MAINTAINERS
index abe5fa7f..10a6f57 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -167,11 +167,11 @@
 P:	Eric Van Hensbergen
 M:	ericvh@gmail.com
 P:	Ron Minnich
-M:	rminnich@lanl.gov
+M:	rminnich@sandia.gov
 P:	Latchesar Ionkov
 M:	lucho@ionkov.net
 L:	v9fs-developer@lists.sourceforge.net
-W:	http://v9fs.sf.net
+W:	http://swik.net/v9fs
 T:	git kernel.org:/pub/scm/linux/kernel/ericvh/v9fs.git
 S:	Maintained
 
diff --git a/fs/9p/fid.c b/fs/9p/fid.c
index 08fa320..15e05a1 100644
--- a/fs/9p/fid.c
+++ b/fs/9p/fid.c
@@ -92,23 +92,6 @@
 	return fid;
 }
 
-struct p9_fid *v9fs_fid_lookup_remove(struct dentry *dentry)
-{
-	struct p9_fid *fid;
-	struct v9fs_dentry *dent;
-
-	dent = dentry->d_fsdata;
-	fid = v9fs_fid_lookup(dentry);
-	if (!IS_ERR(fid)) {
-		spin_lock(&dent->lock);
-		list_del(&fid->dlist);
-		spin_unlock(&dent->lock);
-	}
-
-	return fid;
-}
-
-
 /**
  * v9fs_fid_clone - lookup the fid for a dentry, clone a private copy and
  * 	release it
diff --git a/fs/9p/fid.h b/fs/9p/fid.h
index 47a0ba7..26e07df 100644
--- a/fs/9p/fid.h
+++ b/fs/9p/fid.h
@@ -28,6 +28,5 @@
 };
 
 struct p9_fid *v9fs_fid_lookup(struct dentry *dentry);
-struct p9_fid *v9fs_fid_lookup_remove(struct dentry *dentry);
 struct p9_fid *v9fs_fid_clone(struct dentry *dentry);
 int v9fs_fid_add(struct dentry *dentry, struct p9_fid *fid);
diff --git a/net/9p/conv.c b/net/9p/conv.c
index f2a041c..d979d95 100644
--- a/net/9p/conv.c
+++ b/net/9p/conv.c
@@ -796,6 +796,7 @@
 	if (err) {
 		kfree(fc);
 		fc = ERR_PTR(err);
+		goto error;
 	}
 
 	if (buf_check_overflow(bufp)) {
diff --git a/net/9p/mux.c b/net/9p/mux.c
index acb0388..5d70558 100644
--- a/net/9p/mux.c
+++ b/net/9p/mux.c
@@ -288,9 +288,10 @@
 	m->extended = extended;
 	m->trans = trans;
 	m->tagpool = p9_idpool_create();
-	if (!m->tagpool) {
+	if (IS_ERR(m->tagpool)) {
+		mtmp = ERR_PTR(-ENOMEM);
 		kfree(m);
-		return ERR_PTR(PTR_ERR(m->tagpool));
+		return mtmp;
 	}
 
 	m->err = 0;
@@ -308,8 +309,10 @@
 	memset(&m->poll_waddr, 0, sizeof(m->poll_waddr));
 	m->poll_task = NULL;
 	n = p9_mux_poll_start(m);
-	if (n)
+	if (n) {
+		kfree(m);
 		return ERR_PTR(n);
+	}
 
 	n = trans->poll(trans, &m->pt);
 	if (n & POLLIN) {