• Ben Hutchings's avatar
    Revert "consolemap: Fix a memory leaking bug in drivers/tty/vt/consolemap.c" · 15b3cd8e
    Ben Hutchings authored
    This reverts commit 84ecc2f6.
    
    con_insert_unipair() is working with a sparse 3-dimensional array:
    
    - p->uni_pgdir[] is the top layer
    - p1 points to a middle layer
    - p2 points to a bottom layer
    
    If it needs to allocate a new middle layer, and then fails to allocate
    a new bottom layer, it would previously free only p2, and now it frees
    both p1 and p2.  But since the new middle layer was already registered
    in the top layer, it was not leaked.
    
    However, if it looks up an *existing* middle layer and then fails to
    allocate a bottom layer, it now frees both p1 and p2 but does *not*
    free any other bottom layers under p1.  So it *introduces* a memory
    leak.
    
    The error path also cleared the wrong index in p->uni_pgdir[],
    introducing a use-after-free.
    Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
    Fixes: 84ecc2f6 ("consolemap: Fix a memory leaking bug in drivers/tty/vt/consolemap.c")
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    15b3cd8e
consolemap.c 24.5 KB