> I *think* this makes sense. But it has has had absolutely zero
> testing. It compiles in my config, and the locking is at least
> sensible and well-localized, but maybe I'm missing something.
> 
> Comments?

Yep. Been that way 8)

tty_driver_remove_tty is called from tty_shutdown is called from the
final tty_kref_put can be called from IRQ context.

If you move the tty_driver_remove_tty into the queued part of the code
path then driver->termios[] races appear between the destructor and the
next allocation of the same tty.

Really tty_driver_remove_tty should occur at the end of tty_release, and
tty->termios should simply be a struct ktermios (its a fairly small
structure) and copied back to the drivers array on drivers that need it.
That cleans up pty as well.

Alan