--- linux-2.6.38/drivers/tty/tty_io.c
+++ linux-2.6.38/drivers/tty/tty_io.c
@@ -188,6 +188,7 @@ void free_tty_struct(struct tty_struct *
put_device(tty->dev);
kfree(tty->write_buf);
tty_buffer_free_all(tty);
+ kfree(tty->ldisc);
We should not mess up with ldisc here. We should call something like
tty_ldisc_deinit from tty_init_dev on fail path. The deinit should drop
the reference (call put_ldisc). Or maybe even deinitialize_tty_struct ->
tty_ldisc_deinit -> put_ldisc).
Note that your way you do not drop the module refcount of ld ops.
From the visible functions I see that currently onlytty_ldisc_deref does exactly what we need. But I suspect
kfree(tty);
}
regards,
--
js
suse labs