diff --git a/[refs] b/[refs]
index fe4db5473af0..761816459dd1 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 924f0e4a06419fa1996425d1d2512030e43acbba
+refs/heads/master: 84950cf0ba02fd6a5defe2511bc41f9aa2237632
diff --git a/trunk/net/bluetooth/rfcomm/tty.c b/trunk/net/bluetooth/rfcomm/tty.c
index b2b1cceb102a..ba469b038ea0 100644
--- a/trunk/net/bluetooth/rfcomm/tty.c
+++ b/trunk/net/bluetooth/rfcomm/tty.c
@@ -383,6 +383,10 @@ static int rfcomm_release_dev(void __user *arg)
 	if (req.flags & (1 << RFCOMM_HANGUP_NOW))
 		rfcomm_dlc_close(dev->dlc, 0);
 
+	/* Shut down TTY synchronously before freeing rfcomm_dev */
+	if (dev->tty)
+		tty_vhangup(dev->tty);
+
 	rfcomm_dev_del(dev);
 	rfcomm_dev_put(dev);
 	return 0;