[PATCH] fix tty shutdown race

use-after-free races have been seen due to the workqueue timer in the tty
structure going off after the tty was freed.

Fix that up by using cancel_scheduled_work() and flush_scheduled_work().

diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index ff54795c42a5b60d456856e2fdcea69bd201338a..acacb8cfe527afe4dfbd75f8dc7859956fc420eb 100644 (file)
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -1286,7 +1286,14 @@ static void release_dev(struct file * filp)
        }
        
        /*
-        * Make sure that the tty's task queue isn't activated. 
+        * Prevent flush_to_ldisc() from rescheduling the work for later.  Then
+        * kill any delayed work.
+        */
+       clear_bit(TTY_DONT_FLIP, &tty->flags);
+       cancel_delayed_work(&tty->flip.work);
+
+       /*
+        * Wait for ->hangup_work and ->flip.work handlers to terminate
         */
        flush_scheduled_work();