[PATCH] Fix race on tty close

From: Benjamin Herrenschmidt <benh@kernel.crashing.org>

ldisc close can race with the flush_to_ldisc workqueue.

This patch fixes it by killing the workqueue first.

drivers/char/tty_io.c

@@ -1266,6 +1266,18 @@ static void release_dev(struct file * filp)
 	printk(KERN_DEBUG "freeing tty structure...");
 #endif
 
+	/*
+	 * Prevent flush_to_ldisc() from rescheduling the work for later.  Then
+	 * kill any delayed work.
+	 */
+	clear_bit(TTY_DONT_FLIP, &tty->flags);
+	cancel_delayed_work(&tty->flip.work);
+
+	/*
+	 * Wait for ->hangup_work and ->flip.work handlers to terminate
+	 */
+	flush_scheduled_work();
+
 	/*
 	 * Shutdown the current line discipline, and reset it to N_TTY.
 	 * N.B. why reset ldisc when we're releasing the memory??
@@ -1283,18 +1295,6 @@ static void release_dev(struct file * filp)
 		o_tty->ldisc = ldiscs[N_TTY];
 	}
 
-	/*
-	 * Prevent flush_to_ldisc() from rescheduling the work for later.  Then
-	 * kill any delayed work.
-	 */
-	clear_bit(TTY_DONT_FLIP, &tty->flags);
-	cancel_delayed_work(&tty->flip.work);
-
-	/*
-	 * Wait for ->hangup_work and ->flip.work handlers to terminate
-	 */
-	flush_scheduled_work();
-
 	/* 
 	 * The release_mem function takes care of the details of clearing
 	 * the slots and preserving the termios structure.