diff --git a/[refs] b/[refs]
index 0ce1fa8d1d11..52495e71f97a 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 857196e2758f01ec40f93429013963ca5f22cbae
+refs/heads/master: 00aaae033e323af33740e7012a8ba4b0fa6dce20
diff --git a/trunk/drivers/tty/n_tty.c b/trunk/drivers/tty/n_tty.c
index 101790cea4ae..20de673a7730 100644
--- a/trunk/drivers/tty/n_tty.c
+++ b/trunk/drivers/tty/n_tty.c
@@ -1838,13 +1838,13 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
 
 		if (tty->icanon && !L_EXTPROC(tty)) {
 			/* N.B. avoid overrun if nr == 0 */
+			spin_lock_irqsave(&tty->read_lock, flags);
 			while (nr && tty->read_cnt) {
 				int eol;
 
 				eol = test_and_clear_bit(tty->read_tail,
 						tty->read_flags);
 				c = tty->read_buf[tty->read_tail];
-				spin_lock_irqsave(&tty->read_lock, flags);
 				tty->read_tail = ((tty->read_tail+1) &
 						  (N_TTY_BUF_SIZE-1));
 				tty->read_cnt--;
@@ -1862,15 +1862,19 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file,
 					if (tty_put_user(tty, c, b++)) {
 						retval = -EFAULT;
 						b--;
+						spin_lock_irqsave(&tty->read_lock, flags);
 						break;
 					}
 					nr--;
 				}
 				if (eol) {
 					tty_audit_push(tty);
+					spin_lock_irqsave(&tty->read_lock, flags);
 					break;
 				}
+				spin_lock_irqsave(&tty->read_lock, flags);
 			}
+			spin_unlock_irqrestore(&tty->read_lock, flags);
 			if (retval)
 				break;
 		} else {