do_tty_hangup() does fput() on redirect struct file too early -
it could've been the only holder of tty_struct we are working with and in
that case we'll end up freeing it from fput() and then both reading and
modifying kfreed memory.