1 files changed, 7 insertions, 11 deletions

diff --git a/drivers/char/pty.c b/drivers/char/pty.c
index 3c6b7911665f..6d4582712b1f 100644
--- a/drivers/char/pty.c
+++ b/drivers/char/pty.c
@@ -488,7 +488,6 @@ static void pty_unix98_shutdown(struct tty_struct *tty)
 {
 	/* We have our own method as we don't use the tty index */
 	kfree(tty->termios);
-	kfree(tty->termios_locked);
 }
 
 /* We have no need to install and remove our tty objects as devpts does all
@@ -509,20 +508,17 @@ static int pty_unix98_install(struct tty_driver *driver, struct tty_struct *tty)
 	}
 	initialize_tty_struct(o_tty, driver->other, idx);
 
-	tty->termios = kmalloc(sizeof(struct ktermios), GFP_KERNEL);
+	tty->termios = kzalloc(sizeof(struct ktermios[2]), GFP_KERNEL);
 	if (tty->termios == NULL)
 		goto free_mem_out;
 	*tty->termios = driver->init_termios;
-	tty->termios_locked = kzalloc(sizeof(struct ktermios), GFP_KERNEL);
-	if (tty->termios_locked == NULL)
-		goto free_mem_out;
-	o_tty->termios = kmalloc(sizeof(struct ktermios), GFP_KERNEL);
+	tty->termios_locked = tty->termios + 1;
+
+	o_tty->termios = kzalloc(sizeof(struct ktermios[2]), GFP_KERNEL);
 	if (o_tty->termios == NULL)
 		goto free_mem_out;
 	*o_tty->termios = driver->other->init_termios;
-	o_tty->termios_locked = kzalloc(sizeof(struct ktermios), GFP_KERNEL);
-	if (o_tty->termios_locked == NULL)
-		goto free_mem_out;
+	o_tty->termios_locked = o_tty->termios + 1;
 
 	tty_driver_kref_get(driver->other);
 	if (driver->subtype == PTY_TYPE_MASTER)
@@ -540,10 +536,10 @@ static int pty_unix98_install(struct tty_driver *driver, struct tty_struct *tty)
 	pty_count++;
 	return 0;
 free_mem_out:
-	pty_unix98_shutdown(o_tty);
+	kfree(o_tty->termios);
 	module_put(o_tty->driver->owner);
 	free_tty_struct(o_tty);
-	pty_unix98_shutdown(tty);
+	kfree(tty->termios);
 	return -ENOMEM;
 }