1 files changed, 14 insertions, 0 deletions

diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index f24c26d2dba1..e45326856680 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -1901,6 +1901,20 @@ static int init_dev(struct tty_driver *driver, int idx,
         /* check whether we're reopening an existing tty */
         if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
                 tty = devpts_get_tty(idx);
+                /*
+                 * If we don't have a tty here on a slave open, it's because
+                 * the master already started the close process and there's
+                 * no relation between devpts file and tty anymore.
+                 */
+                if (!tty && driver->subtype == PTY_TYPE_SLAVE) {
+                        retval = -EIO;
+                        goto end_init;
+                }
+                /*
+                 * It's safe from now on because init_dev() is called with
+                 * tty_mutex held and release_dev() won't change tty->count
+                 * or tty->flags without having to grab tty_mutex
+                 */
                 if (tty && driver->subtype == PTY_TYPE_MASTER)
                         tty = tty->link;
         } else {