The TI shared transport is published before probe completes and remains
published while remove tears its core down.  The exported protocol entry
points can retain the raw core pointer across that teardown.  An attached
N_TI_WL line discipline and its write-wakeup work provide another path to
the same freed core.

This series publishes only fully initialized transports, accounts users of
the published pointer, withdraws and drains that pointer on remove, and
synchronously closes an attached TTY before freeing the core.

This is an RFC for the 6.6 stable tree because the driver is still present
there but was removed from mainline by commit 78fe66360ed6 ("misc: ti-st:
st_kim: remove the driver").  There is consequently no current mainline
code location through which these fixes can first be merged.

The patches are based on linux-6.6.y commit da47cbc25466.

Hongyan Xu (4):
  misc: ti-st: publish the transport only after probe succeeds
  misc: ti-st: account published transport users
  misc: ti-st: drain published users before transport removal
  misc: ti-st: synchronize TTY teardown with transport removal

 drivers/misc/ti-st/st_core.c | 59 +++++++++++++++++++++++---------
 drivers/misc/ti-st/st_kim.c  | 65 ++++++++++++++++++++++--------------
 include/linux/ti_wilink_st.h |  8 +++++
 3 files changed, 91 insertions(+), 41 deletions(-)

-- 
2.50.1.windows.1