3 files changed, 15 insertions, 1 deletions

diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 68865d9af8a0..16793eccc6ae 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -153,6 +153,12 @@ static void n_tty_set_room(struct tty_struct *tty)
         if (left && !old_left) {
                 WARN_RATELIMIT(tty->port->itty == NULL,
                                 "scheduling with invalid itty\n");
+                /* see if ldisc has been killed - if so, this means that
+                 * even though the ldisc has been halted and ->buf.work
+                 * cancelled, ->buf.work is about to be rescheduled
+                 */
+                WARN_RATELIMIT(test_bit(TTY_LDISC_HALTED, &tty->flags),
+                               "scheduling buffer work for halted ldisc\n");
                 schedule_work(&tty->port->buf.work);
         }
 }
@@ -1624,6 +1630,8 @@ static int n_tty_open(struct tty_struct *tty)
                 goto err_free_bufs;
 
         tty->disc_data = ldata;
+        /* indicate buffer work may resume */
+        clear_bit(TTY_LDISC_HALTED, &tty->flags);
         reset_buffer_flags(tty);
         tty_unthrottle(tty);
         ldata->column = 0;
diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
index d794087c327e..c641321b9404 100644
--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -375,6 +375,7 @@ static inline void tty_ldisc_put(struct tty_ldisc *ld)
 
 void tty_ldisc_enable(struct tty_struct *tty)
 {
+        clear_bit(TTY_LDISC_HALTED, &tty->flags);
         set_bit(TTY_LDISC, &tty->flags);
         clear_bit(TTY_LDISC_CHANGING, &tty->flags);
         wake_up(&tty_ldisc_wait);
@@ -513,8 +514,11 @@ static void tty_ldisc_restore(struct tty_struct *tty, struct tty_ldisc *old)
 
 static int tty_ldisc_halt(struct tty_struct *tty)
 {
+        int scheduled;
         clear_bit(TTY_LDISC, &tty->flags);
-        return cancel_work_sync(&tty->port->buf.work);
+        scheduled = cancel_work_sync(&tty->port->buf.work);
+        set_bit(TTY_LDISC_HALTED, &tty->flags);
+        return scheduled;
 }
 
 /**
@@ -820,6 +824,7 @@ void tty_ldisc_hangup(struct tty_struct *tty)
         clear_bit(TTY_LDISC, &tty->flags);
         tty_unlock(tty);
         cancel_work_sync(&tty->port->buf.work);
+        set_bit(TTY_LDISC_HALTED, &tty->flags);
         mutex_unlock(&tty->ldisc_mutex);
 retry:
         tty_lock(tty);
diff --git a/include/linux/tty.h b/include/linux/tty.h
index d3548f871968..66ae020e8a98 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -315,6 +315,7 @@ struct tty_file_private {
 #define TTY_NO_WRITE_SPLIT      17      /* Preserve write boundaries to driver */
 #define TTY_HUPPED              18      /* Post driver->hangup() */
 #define TTY_HUPPING             21      /* ->hangup() in progress */
+#define TTY_LDISC_HALTED        22      /* Line discipline is halted */
 
 #define TTY_WRITE_FLUSH(tty) tty_write_flush((tty))