K 10
svn:author
V 5
markj
K 8
svn:date
V 27
2019-07-04T15:42:02.391004Z
K 7
svn:log
V 397
Defer funsetown() calls for a TTY to tty_rel_free().

We were otherwise failing to call funsetown() for some descriptors
associated with a tty, such as pts descriptors.  Then, if the
descriptor is closed before the owner exits, we may get memory
corruption.

Reported by:	syzbot+c9b6206303bf47bac87e@syzkaller.appspotmail.com
Reviewed by:	ed
MFC after:	3 days
Sponsored by:	The FreeBSD Foundation

END