hvcs: Get reference to tty in remove

Grab a reference to the tty when removing the hvcs to ensure
it does not get freed unexpectedly.

Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Link: https://lore.kernel.org/r/20230203155802.404324-4-brking@linux.vnet.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c
index 5229107160256f74e3d806ff260dc8d606e30278..8d40b20de27740245d095fc898c6592a6364bea6 100644 (file)
--- a/drivers/tty/hvc/hvcs.c
+++ b/drivers/tty/hvc/hvcs.c
@@ -799,7 +799,7 @@ static void hvcs_remove(struct vio_dev *dev)
 
        spin_lock_irqsave(&hvcsd->lock, flags);
 
-       tty = hvcsd->port.tty;
+       tty = tty_port_tty_get(&hvcsd->port);
 
        spin_unlock_irqrestore(&hvcsd->lock, flags);
 
@@ -814,8 +814,10 @@ static void hvcs_remove(struct vio_dev *dev)
         * hvcs_hangup.  The tty should always be valid at this time unless a
         * simultaneous tty close already cleaned up the hvcs_struct.
         */
-       if (tty)
+       if (tty) {
                tty_hangup(tty);
+               tty_kref_put(tty);
+       }
 
        printk(KERN_INFO "HVCS: vty-server@%X removed from the"
                        " vio bus.\n", dev->unit_address);