Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6:
  USB: isp1362: fix build failure on ARM systems via irq_flags cleanup
  USB: isp1362: better 64bit printf warning fixes
  USB: fix usbstorage for 2770:915d delivers no FAT
  USB: Fix level of isp1760 Reloading ptd error message
  USB: FHCI: avoid NULL pointer dereference
  USB: Fix duplicate sysfs problem after device reset.
  USB: add speed values for USB 3.0 and wireless controllers
  USB: add missing delay during remote wakeup
  USB: EHCI & UHCI: fix race between root-hub suspend and port resume
  USB: EHCI: fix handling of unusual interrupt intervals
  USB: Don't use GFP_KERNEL while we cannot reset a storage device
  USB: fix bitmask merge error
  usb: serial: fix memory leak in generic driver
  USB: serial: fix USB serial fix kfifo_len locking

1 files changed, 6 insertions, 4 deletions

diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index f1ea3a33b6e6..83443d6306d6 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -386,12 +386,12 @@ int usb_serial_generic_chars_in_buffer(struct tty_struct *tty)
 
         dbg("%s - port %d", __func__, port->number);
 
-        if (serial->type->max_in_flight_urbs) {
-                spin_lock_irqsave(&port->lock, flags);
+        spin_lock_irqsave(&port->lock, flags);
+        if (serial->type->max_in_flight_urbs)
                 chars = port->tx_bytes_flight;
-                spin_unlock_irqrestore(&port->lock, flags);
-        } else if (serial->num_bulk_out)
+        else if (serial->num_bulk_out)
                 chars = kfifo_len(&port->write_fifo);
+        spin_unlock_irqrestore(&port->lock, flags);
 
         dbg("%s - returns %d", __func__, chars);
         return chars;
@@ -489,6 +489,8 @@ void usb_serial_generic_write_bulk_callback(struct urb *urb)
         dbg("%s - port %d", __func__, port->number);
 
         if (port->serial->type->max_in_flight_urbs) {
+                kfree(urb->transfer_buffer);
+
                 spin_lock_irqsave(&port->lock, flags);
                 --port->urbs_in_flight;
                 port->tx_bytes_flight -= urb->transfer_buffer_length;