diff --git a/sys/kern/tty_subr.c b/sys/kern/tty_subr.c @@ -77,6 +77,14 @@ cl->c_cc = count; cl->c_ccmax = ccmax; cl->c_cchead = 0; + /* + * Free the PREVIOUS c_data buffer before dropping our only reference to + * it. Without this every reallocation to a different non-zero size leaks + * one M_TTYS allocation (DF-2556). Guard the first allocation, where + * c_data is still NULL. + */ + if (cl->c_data != NULL) + kfree(cl->c_data, M_TTYS); cl->c_data = data; }