Ok, here's my proposed fix, which appears to work with preempt.  I haven't
tested on non-preempt, nor (obviously since its from me) SMP.  However,
I forsee no problems caused by this change.

release_dev() sets filp->private_data to NULL when the tty layer has
done with the file descriptor.  However, it remains on the tty_files
list until __fput completes.