3 files changed, 21 insertions, 11 deletions

diff --git a/drivers/net/ppp/ppp_async.c b/drivers/net/ppp/ppp_async.c
index a031f6b456b4..9c889e0303dd 100644
--- a/drivers/net/ppp/ppp_async.c
+++ b/drivers/net/ppp/ppp_async.c
@@ -314,7 +314,7 @@ ppp_asynctty_ioctl(struct tty_struct *tty, struct file *file,
                 /* flush our buffers and the serial port's buffer */
                 if (arg == TCIOFLUSH || arg == TCOFLUSH)
                         ppp_async_flush_output(ap);
-                err = tty_perform_flush(tty, arg);
+                err = n_tty_ioctl_helper(tty, file, cmd, arg);
                 break;
 
         case FIONREAD:
diff --git a/drivers/net/ppp/ppp_synctty.c b/drivers/net/ppp/ppp_synctty.c
index 1a12033d2efa..bdf3b13a71a8 100644
--- a/drivers/net/ppp/ppp_synctty.c
+++ b/drivers/net/ppp/ppp_synctty.c
@@ -355,7 +355,7 @@ ppp_synctty_ioctl(struct tty_struct *tty, struct file *file,
                 /* flush our buffers and the serial port's buffer */
                 if (arg == TCIOFLUSH || arg == TCOFLUSH)
                         ppp_sync_flush_output(ap);
-                err = tty_perform_flush(tty, arg);
+                err = n_tty_ioctl_helper(tty, file, cmd, arg);
                 break;
 
         case FIONREAD:
diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c
index 28715e48b2f7..d119034877de 100644
--- a/drivers/tty/tty_ioctl.c
+++ b/drivers/tty/tty_ioctl.c
@@ -1122,14 +1122,12 @@ int tty_mode_ioctl(struct tty_struct *tty, struct file *file,
 }
 EXPORT_SYMBOL_GPL(tty_mode_ioctl);
 
-int tty_perform_flush(struct tty_struct *tty, unsigned long arg)
+
+/* Caller guarantees ldisc reference is held */
+static int __tty_perform_flush(struct tty_struct *tty, unsigned long arg)
 {
-        struct tty_ldisc *ld;
-        int retval = tty_check_change(tty);
-        if (retval)
-                return retval;
+        struct tty_ldisc *ld = tty->ldisc;
 
-        ld = tty_ldisc_ref_wait(tty);
         switch (arg) {
         case TCIFLUSH:
                 if (ld && ld->ops->flush_buffer) {
@@ -1147,12 +1145,24 @@ int tty_perform_flush(struct tty_struct *tty, unsigned long arg)
                 tty_driver_flush_buffer(tty);
                 break;
         default:
-                tty_ldisc_deref(ld);
                 return -EINVAL;
         }
-        tty_ldisc_deref(ld);
         return 0;
 }
+
+int tty_perform_flush(struct tty_struct *tty, unsigned long arg)
+{
+        struct tty_ldisc *ld;
+        int retval = tty_check_change(tty);
+        if (retval)
+                return retval;
+
+        ld = tty_ldisc_ref_wait(tty);
+        retval = __tty_perform_flush(tty, arg);
+        if (ld)
+                tty_ldisc_deref(ld);
+        return retval;
+}
 EXPORT_SYMBOL_GPL(tty_perform_flush);
 
 int n_tty_ioctl_helper(struct tty_struct *tty, struct file *file,
@@ -1191,7 +1201,7 @@ int n_tty_ioctl_helper(struct tty_struct *tty, struct file *file,
                 }
                 return 0;
         case TCFLSH:
-                return tty_perform_flush(tty, arg);
+                return __tty_perform_flush(tty, arg);
         default:
                 /* Try the mode commands */
                 return tty_mode_ioctl(tty, file, cmd, arg);