[patch 1/3] x86/ldt: Free the right LDT memory in write_ldt() error path

[Thomas Gleixner]

The error path in write_ldt() frees the already installed LDT memory
instead of the newly allocated which cannot be installed.

Fixes: f55f0501cbf6 ("x86/pti: Put the LDT in its own PGD if PTI is on")
Reported-by: Mathieu Desnoyers <mathieu.desnoy...@efficios.com>
Signed-off-by: Thomas Gleixner <t...@linutronix.de>
---
 arch/x86/kernel/ldt.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/arch/x86/kernel/ldt.c
+++ b/arch/x86/kernel/ldt.c
@@ -421,7 +421,7 @@ static int write_ldt(void __user *ptr, u
         */
        error = map_ldt_struct(mm, new_ldt, old_ldt ? !old_ldt->slot : 0);
        if (error) {
-               free_ldt_struct(old_ldt);
+               free_ldt_struct(new_ldt);
                goto out_unlock;
        }