[SRU][J][F][PATCH 6/8] hvcs: Get reference to tty in remove

[frank.heimes at canonical.com]

From: Brian King <brking at linux.vnet.ibm.com>

BugLink: https://bugs.launchpad.net/bugs/2056373

Grab a reference to the tty when removing the hvcs to ensure
it does not get freed unexpectedly.

Signed-off-by: Brian King <brking at linux.vnet.ibm.com>
Link: https://lore.kernel.org/r/20230203155802.404324-4-brking@linux.vnet.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
(cherry picked from commit 3a8d3b366ce47024bf274eac783f8af5df2780f5)
Signed-off-by: Frank Heimes <frank.heimes at canonical.com>
---
 drivers/tty/hvc/hvcs.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c
index 5c0fd72dd0f1..d3c95b2c8eca 100644
--- a/drivers/tty/hvc/hvcs.c
+++ b/drivers/tty/hvc/hvcs.c
@@ -829,7 +829,7 @@ static int hvcs_remove(struct vio_dev *dev)
 
 	spin_lock_irqsave(&hvcsd->lock, flags);
 
-	tty = hvcsd->port.tty;
+	tty = tty_port_tty_get(&hvcsd->port);
 
 	spin_unlock_irqrestore(&hvcsd->lock, flags);
 
@@ -844,8 +844,10 @@ static int hvcs_remove(struct vio_dev *dev)
 	 * hvcs_hangup.  The tty should always be valid at this time unless a
 	 * simultaneous tty close already cleaned up the hvcs_struct.
 	 */
-	if (tty)
+	if (tty) {
 		tty_hangup(tty);
+		tty_kref_put(tty);
+	}
 
 	printk(KERN_INFO "HVCS: vty-server@%X removed from the"
 			" vio bus.\n", dev->unit_address);
-- 
2.25.1