From 335adde689150d2fcf4df3cb26a6fc6740ed1f3e Mon Sep 17 00:00:00 2001
From: Alan Cox <alan@redhat.com>
Date: Mon, 13 Oct 2008 10:43:48 +0100
Subject: [PATCH] pty: Fix allocation failure double free

The updating and moving around of the pty code added a bug where both the
helper and caller free the main tty struct (the pty driver must free the
o_tty pair itself however).

Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
---
 drivers/char/pty.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/char/pty.c b/drivers/char/pty.c
index c3ab8c3110c9..3c6b7911665f 100644
--- a/drivers/char/pty.c
+++ b/drivers/char/pty.c
@@ -544,8 +544,6 @@ static int pty_unix98_install(struct tty_driver *driver, struct tty_struct *tty)
 	module_put(o_tty->driver->owner);
 	free_tty_struct(o_tty);
 	pty_unix98_shutdown(tty);
-	free_tty_struct(tty);
-	module_put(driver->owner);
 	return -ENOMEM;
 }
 
-- 
GitLab