2 files changed, 25 insertions, 18 deletions

diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index 59af3945ea85..65c7c62c7aae 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -633,7 +633,6 @@ static int ptmx_open(struct inode *inode, struct file *filp)
         mutex_unlock(&devpts_mutex);
 
         mutex_lock(&tty_mutex);
-        mutex_lock(&devpts_mutex);
         tty = tty_init_dev(ptm_driver, index);
 
         if (IS_ERR(tty)) {
@@ -643,7 +642,6 @@ static int ptmx_open(struct inode *inode, struct file *filp)
 
         /* The tty returned here is locked so we can safely
            drop the mutex */
-        mutex_unlock(&devpts_mutex);
         mutex_unlock(&tty_mutex);
 
         set_bit(TTY_PTY_LOCK, &tty->flags); /* LOCK THE SLAVE */
diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
index 173a9000a6cb..ba8be396a621 100644
--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -894,6 +894,23 @@ int tty_ldisc_setup(struct tty_struct *tty, struct tty_struct *o_tty)
         tty_ldisc_enable(tty);
         return 0;
 }
+
+static void tty_ldisc_kill(struct tty_struct *tty)
+{
+        mutex_lock(&tty->ldisc_mutex);
+        /*
+         * Now kill off the ldisc
+         */
+        tty_ldisc_close(tty, tty->ldisc);
+        tty_ldisc_put(tty->ldisc);
+        /* Force an oops if we mess this up */
+        tty->ldisc = NULL;
+
+        /* Ensure the next open requests the N_TTY ldisc */
+        tty_set_termios_ldisc(tty, N_TTY);
+        mutex_unlock(&tty->ldisc_mutex);
+}
+
 /**
  *      tty_ldisc_release               -       release line discipline
  *      @tty: tty being shut down
@@ -912,27 +929,19 @@ void tty_ldisc_release(struct tty_struct *tty, struct tty_struct *o_tty)
          * race with the set_ldisc code path.
          */
 
-        tty_unlock(tty);
+        tty_unlock_pair(tty, o_tty);
         tty_ldisc_halt(tty);
         tty_ldisc_flush_works(tty);
-        tty_lock(tty);
-
-        mutex_lock(&tty->ldisc_mutex);
-        /*
-         * Now kill off the ldisc
-         */
-        tty_ldisc_close(tty, tty->ldisc);
-        tty_ldisc_put(tty->ldisc);
-        /* Force an oops if we mess this up */
-        tty->ldisc = NULL;
+        if (o_tty) {
+                tty_ldisc_halt(o_tty);
+                tty_ldisc_flush_works(o_tty);
+        }
+        tty_lock_pair(tty, o_tty);
 
-        /* Ensure the next open requests the N_TTY ldisc */
-        tty_set_termios_ldisc(tty, N_TTY);
-        mutex_unlock(&tty->ldisc_mutex);
 
-        /* This will need doing differently if we need to lock */
+        tty_ldisc_kill(tty);
         if (o_tty)
-                tty_ldisc_release(o_tty, NULL);
+                tty_ldisc_kill(o_tty);
 
         /* And the memory resources remaining (buffers, termios) will be
            disposed of when the kref hits zero */