]> git.baikalelectronics.ru Git - kernel.git/commit
Revert "consolemap: Fix a memory leaking bug in drivers/tty/vt/consolemap.c"
authorBen Hutchings <ben@decadent.org.uk>
Tue, 4 Jun 2019 18:00:39 +0000 (19:00 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 4 Jun 2019 19:01:58 +0000 (21:01 +0200)
commita1c919fd6b3b62a9dd0c98b6f596b0656b425276
tree44ddb9718ea9eefa8c50bc7ad64b01e2b58c43c2
parentc2cccc9e32a101375fa28c1d8b9a38fc58023b6e
Revert "consolemap: Fix a memory leaking bug in drivers/tty/vt/consolemap.c"

This reverts commit fcea45186f59edf9a31bf8c1a06af896c66c987c.

con_insert_unipair() is working with a sparse 3-dimensional array:

- p->uni_pgdir[] is the top layer
- p1 points to a middle layer
- p2 points to a bottom layer

If it needs to allocate a new middle layer, and then fails to allocate
a new bottom layer, it would previously free only p2, and now it frees
both p1 and p2.  But since the new middle layer was already registered
in the top layer, it was not leaked.

However, if it looks up an *existing* middle layer and then fails to
allocate a bottom layer, it now frees both p1 and p2 but does *not*
free any other bottom layers under p1.  So it *introduces* a memory
leak.

The error path also cleared the wrong index in p->uni_pgdir[],
introducing a use-after-free.

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Fixes: fcea45186f59 ("consolemap: Fix a memory leaking bug in drivers/tty/vt/consolemap.c")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/tty/vt/consolemap.c