tty: USB hangup is racy

The USB layer uses tty_hangup to deal with unplugs of the physical hardware
(analogous to loss of carrier) and then frees the resources. However the
tty_hangup is asynchronous. As the hangup can sleep we can use tty_vhangup
which is the non async version to avoid freeing resources too early.

Signed-off-by: Alan Cox <[email protected]>
Cc: stable <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 99188c92068bb4492416ff99b7655086721c9034..21dd72a5a715aac46bd268558e8a3cb6baa9c354 100644 (file)
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -1161,10 +1161,7 @@ void usb_serial_disconnect(struct usb_interface *interface)
                if (port) {
                        struct tty_struct *tty = tty_port_tty_get(&port->port);
                        if (tty) {
-                               /* The hangup will occur asynchronously but
-                                  the object refcounts will sort out all the
-                                  cleanup */
-                               tty_hangup(tty);
+                               tty_vhangup(tty);
                                tty_kref_put(tty);
                        }
                        kill_traffic(port);