tty: Complete ownership transfer of flip buffers

Waiting for buffer work to complete is not required for safely
performing changes to the line discipline, once the line discipline
is halted. The buffer work routine, flush_to_ldisc(), will be
unable to acquire an ldisc ref and all existing references were
waited until released (so it can't already have one).

Ensure running buffer work which may reference the soon-to-be-gone
tty completes and any buffer work running after this point retrieves
a NULL tty.

Also, ensure all buffer work is cancelled on port destruction.

Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 1 insertions, 0 deletions

diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index e6ee0f459a20..458763418701 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -1595,6 +1595,7 @@ static void release_tty(struct tty_struct *tty, int idx)
         tty_free_termios(tty);
         tty_driver_remove_tty(tty->driver, tty);
         tty->port->itty = NULL;
+        cancel_work_sync(&tty->port->buf.work);
 
         if (tty->link)
                 tty_kref_put(tty->link);