On Wed, Aug 10, 2011 at 12:38:17AM +0100, Al Viro wrote:

	* tty-on-xterm sometimes crashes on the first keysyms reaching it;
as far as I can tell, it's something related to SIGWINCH handling - whether
it happens or not depends on the way xterm windows are laid out and flipping
between them first seems to prevent that shit.  If it hasn't happened at once,
it won't happen at all...  Something in drivers/chan or drivers/line, most
likely...

FWIW, what I'm seeing there is chan_interrupt() with tty that has definitely
been kfree'd.  What happens is that we have several opened files for
given tty and they all get closed in parallel.  Now, ->release() of
tty calls ->close() of driver (line_close() in this case) and then
gets around to decrementing tty->count.  As the result, *all* callers
of line_close() see line->tty->count > 1 and leave line->tty not reset to
NULL.  Oops...

Moral: do not use the counters on upper layer objects unless you know
what you are doing *and* know what will happen to that upper layer in
years to come...