Skip to content

Commit

Permalink
vt: fix unicode console freeing with a common interface
Browse files Browse the repository at this point in the history
By directly using kfree() in different places we risk missing one if
it is switched to using vfree(), especially if the corresponding
vmalloc() is hidden away within a common abstraction.

Oh wait, that's exactly what happened here.

So let's fix this by creating a common abstraction for the free case
as well.

Signed-off-by: Nicolas Pitre <nico@fluxnic.net>
Reported-by: syzbot+0bfda3ade1ee9288a1be@syzkaller.appspotmail.com
Fixes: 9a98e7a ("vt: don't use kmalloc() for the unicode screen buffer")
Cc: <stable@vger.kernel.org>
Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://lore.kernel.org/r/nycvar.YSQ.7.76.2005021043110.2671@knanqh.ubzr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
Nicolas Pitre authored and Greg Kroah-Hartman committed May 4, 2020
1 parent 092a9f5 commit 57d38f2
Showing 1 changed file with 7 additions and 2 deletions.
9 changes: 7 additions & 2 deletions drivers/tty/vt/vt.c
Original file line number Diff line number Diff line change
Expand Up @@ -365,9 +365,14 @@ static struct uni_screen *vc_uniscr_alloc(unsigned int cols, unsigned int rows)
return uniscr;
}

static void vc_uniscr_free(struct uni_screen *uniscr)
{
vfree(uniscr);
}

static void vc_uniscr_set(struct vc_data *vc, struct uni_screen *new_uniscr)
{
vfree(vc->vc_uni_screen);
vc_uniscr_free(vc->vc_uni_screen);
vc->vc_uni_screen = new_uniscr;
}

Expand Down Expand Up @@ -1230,7 +1235,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
err = resize_screen(vc, new_cols, new_rows, user);
if (err) {
kfree(newscreen);
kfree(new_uniscr);
vc_uniscr_free(new_uniscr);
return err;
}

Expand Down

0 comments on commit 57d38f2

Please sign in to comment.