The ptmx_open path takes the tty and devpts locks in the wrong order
because tty_init_dev locks and returns a locked tty. As far as I can
tell this is actually safe anyway because the tty being returned is new
so nobody can get a reference to lock it at this point.
However we don't even need the devpts lock at this point, it's only held
as a byproduct of the way the locks were pushe down.