aboutsummaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorAlan Cox <alan@redhat.com>2008-10-13 05:39:46 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2008-10-13 12:51:41 -0400
commit4a90f09b20f4622dcbff1f0e1e6bae1704f8ad8c (patch)
tree9b275f88f2705cb10121d5982741aef3a088a7c8 /drivers
parent95f9bfc6b76e862265a2d70ae061eec18fe14140 (diff)
tty: usb-serial krefs
Use kref in the USB serial drivers so that we don't free tty structures from under the URB receive handlers as has historically been the case if you were unlucky. This also gives us a framework for general tty drivers to use tty_port objects and refcount. Contains two err->dev_err changes merged together to fix clashes in the -next tree. Signed-off-by: Alan Cox <alan@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/char/tty_port.c41
-rw-r--r--drivers/usb/serial/aircable.c15
-rw-r--r--drivers/usb/serial/belkin_sa.c3
-rw-r--r--drivers/usb/serial/console.c8
-rw-r--r--drivers/usb/serial/cyberjack.c3
-rw-r--r--drivers/usb/serial/cypress_m8.c5
-rw-r--r--drivers/usb/serial/digi_acceleport.c19
-rw-r--r--drivers/usb/serial/empeg.c8
-rw-r--r--drivers/usb/serial/ftdi_sio.c19
-rw-r--r--drivers/usb/serial/garmin_gps.c3
-rw-r--r--drivers/usb/serial/generic.c3
-rw-r--r--drivers/usb/serial/io_edgeport.c43
-rw-r--r--drivers/usb/serial/io_ti.c26
-rw-r--r--drivers/usb/serial/ipaq.c3
-rw-r--r--drivers/usb/serial/ipw.c3
-rw-r--r--drivers/usb/serial/ir-usb.c3
-rw-r--r--drivers/usb/serial/iuu_phoenix.c3
-rw-r--r--drivers/usb/serial/keyspan.c77
-rw-r--r--drivers/usb/serial/keyspan_pda.c16
-rw-r--r--drivers/usb/serial/kl5kusb105.c3
-rw-r--r--drivers/usb/serial/kobil_sct.c3
-rw-r--r--drivers/usb/serial/mct_u232.c6
-rw-r--r--drivers/usb/serial/mos7720.c36
-rw-r--r--drivers/usb/serial/mos7840.c7
-rw-r--r--drivers/usb/serial/navman.c3
-rw-r--r--drivers/usb/serial/omninet.c10
-rw-r--r--drivers/usb/serial/option.c18
-rw-r--r--drivers/usb/serial/oti6858.c3
-rw-r--r--drivers/usb/serial/pl2303.c4
-rw-r--r--drivers/usb/serial/safe_serial.c11
-rw-r--r--drivers/usb/serial/sierra.c16
-rw-r--r--drivers/usb/serial/spcp8x5.c3
-rw-r--r--drivers/usb/serial/ti_usb_3410_5052.c44
-rw-r--r--drivers/usb/serial/usb-serial.c24
-rw-r--r--drivers/usb/serial/visor.c18
-rw-r--r--drivers/usb/serial/whiteheat.c8
36 files changed, 310 insertions, 208 deletions
diff --git a/drivers/char/tty_port.c b/drivers/char/tty_port.c
index 6fadb19d630b..553b0e9d8d17 100644
--- a/drivers/char/tty_port.c
+++ b/drivers/char/tty_port.c
@@ -23,6 +23,7 @@ void tty_port_init(struct tty_port *port)
23 init_waitqueue_head(&port->open_wait); 23 init_waitqueue_head(&port->open_wait);
24 init_waitqueue_head(&port->close_wait); 24 init_waitqueue_head(&port->close_wait);
25 mutex_init(&port->mutex); 25 mutex_init(&port->mutex);
26 spin_lock_init(&port->lock);
26 port->close_delay = (50 * HZ) / 100; 27 port->close_delay = (50 * HZ) / 100;
27 port->closing_wait = (3000 * HZ) / 100; 28 port->closing_wait = (3000 * HZ) / 100;
28} 29}
@@ -53,3 +54,43 @@ void tty_port_free_xmit_buf(struct tty_port *port)
53EXPORT_SYMBOL(tty_port_free_xmit_buf); 54EXPORT_SYMBOL(tty_port_free_xmit_buf);
54 55
55 56
57/**
58 * tty_port_tty_get - get a tty reference
59 * @port: tty port
60 *
61 * Return a refcount protected tty instance or NULL if the port is not
62 * associated with a tty (eg due to close or hangup)
63 */
64
65struct tty_struct *tty_port_tty_get(struct tty_port *port)
66{
67 unsigned long flags;
68 struct tty_struct *tty;
69
70 spin_lock_irqsave(&port->lock, flags);
71 tty = tty_kref_get(port->tty);
72 spin_unlock_irqrestore(&port->lock, flags);
73 return tty;
74}
75EXPORT_SYMBOL(tty_port_tty_get);
76
77/**
78 * tty_port_tty_set - set the tty of a port
79 * @port: tty port
80 * @tty: the tty
81 *
82 * Associate the port and tty pair. Manages any internal refcounts.
83 * Pass NULL to deassociate a port
84 */
85
86void tty_port_tty_set(struct tty_port *port, struct tty_struct *tty)
87{
88 unsigned long flags;
89
90 spin_lock_irqsave(&port->lock, flags);
91 if (port->tty)
92 tty_kref_put(port->tty);
93 port->tty = tty;
94 spin_unlock_irqrestore(&port->lock, flags);
95}
96EXPORT_SYMBOL(tty_port_tty_set);
diff --git a/drivers/usb/serial/aircable.c b/drivers/usb/serial/aircable.c
index 79ea98c66fa8..99fb7dc59c45 100644
--- a/drivers/usb/serial/aircable.c
+++ b/drivers/usb/serial/aircable.c
@@ -272,7 +272,7 @@ static void aircable_read(struct work_struct *work)
272 * 64 bytes, to ensure I do not get throttled. 272 * 64 bytes, to ensure I do not get throttled.
273 * Ask USB mailing list for better aproach. 273 * Ask USB mailing list for better aproach.
274 */ 274 */
275 tty = port->port.tty; 275 tty = tty_port_tty_get(&port->port);
276 276
277 if (!tty) { 277 if (!tty) {
278 schedule_work(&priv->rx_work); 278 schedule_work(&priv->rx_work);
@@ -283,12 +283,13 @@ static void aircable_read(struct work_struct *work)
283 count = min(64, serial_buf_data_avail(priv->rx_buf)); 283 count = min(64, serial_buf_data_avail(priv->rx_buf));
284 284
285 if (count <= 0) 285 if (count <= 0)
286 return; /* We have finished sending everything. */ 286 goto out; /* We have finished sending everything. */
287 287
288 tty_prepare_flip_string(tty, &data, count); 288 tty_prepare_flip_string(tty, &data, count);
289 if (!data) { 289 if (!data) {
290 err("%s- kzalloc(%d) failed.", __func__, count); 290 dev_err(&port->dev, "%s- kzalloc(%d) failed.",
291 return; 291 __func__, count);
292 goto out;
292 } 293 }
293 294
294 serial_buf_get(priv->rx_buf, data, count); 295 serial_buf_get(priv->rx_buf, data, count);
@@ -297,7 +298,8 @@ static void aircable_read(struct work_struct *work)
297 298
298 if (serial_buf_data_avail(priv->rx_buf)) 299 if (serial_buf_data_avail(priv->rx_buf))
299 schedule_work(&priv->rx_work); 300 schedule_work(&priv->rx_work);
300 301out:
302 tty_kref_put(tty);
301 return; 303 return;
302} 304}
303/* End of private methods */ 305/* End of private methods */
@@ -495,7 +497,7 @@ static void aircable_read_bulk_callback(struct urb *urb)
495 usb_serial_debug_data(debug, &port->dev, __func__, 497 usb_serial_debug_data(debug, &port->dev, __func__,
496 urb->actual_length, urb->transfer_buffer); 498 urb->actual_length, urb->transfer_buffer);
497 499
498 tty = port->port.tty; 500 tty = tty_port_tty_get(&port->port);
499 if (tty && urb->actual_length) { 501 if (tty && urb->actual_length) {
500 if (urb->actual_length <= 2) { 502 if (urb->actual_length <= 2) {
501 /* This is an incomplete package */ 503 /* This is an incomplete package */
@@ -527,6 +529,7 @@ static void aircable_read_bulk_callback(struct urb *urb)
527 } 529 }
528 aircable_read(&priv->rx_work); 530 aircable_read(&priv->rx_work);
529 } 531 }
532 tty_kref_put(tty);
530 533
531 /* Schedule the next read _if_ we are still open */ 534 /* Schedule the next read _if_ we are still open */
532 if (port->port.count) { 535 if (port->port.count) {
diff --git a/drivers/usb/serial/belkin_sa.c b/drivers/usb/serial/belkin_sa.c
index 2ebe06c3405a..1913bc7c5f0b 100644
--- a/drivers/usb/serial/belkin_sa.c
+++ b/drivers/usb/serial/belkin_sa.c
@@ -322,7 +322,7 @@ static void belkin_sa_read_int_callback(struct urb *urb)
322 * to look in to this before committing any code. 322 * to look in to this before committing any code.
323 */ 323 */
324 if (priv->last_lsr & BELKIN_SA_LSR_ERR) { 324 if (priv->last_lsr & BELKIN_SA_LSR_ERR) {
325 tty = port->port.tty; 325 tty = tty_port_tty_get(&port->port);
326 /* Overrun Error */ 326 /* Overrun Error */
327 if (priv->last_lsr & BELKIN_SA_LSR_OE) { 327 if (priv->last_lsr & BELKIN_SA_LSR_OE) {
328 } 328 }
@@ -335,6 +335,7 @@ static void belkin_sa_read_int_callback(struct urb *urb)
335 /* Break Indicator */ 335 /* Break Indicator */
336 if (priv->last_lsr & BELKIN_SA_LSR_BI) { 336 if (priv->last_lsr & BELKIN_SA_LSR_BI) {
337 } 337 }
338 tty_kref_put(tty);
338 } 339 }
339#endif 340#endif
340 spin_unlock_irqrestore(&priv->lock, flags); 341 spin_unlock_irqrestore(&priv->lock, flags);
diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c
index e980766bb84b..5b20de130e08 100644
--- a/drivers/usb/serial/console.c
+++ b/drivers/usb/serial/console.c
@@ -117,7 +117,7 @@ static int usb_console_setup(struct console *co, char *options)
117 } 117 }
118 118
119 port = serial->port[0]; 119 port = serial->port[0];
120 port->port.tty = NULL; 120 tty_port_tty_set(&port->port, NULL);
121 121
122 info->port = port; 122 info->port = port;
123 123
@@ -143,7 +143,7 @@ static int usb_console_setup(struct console *co, char *options)
143 } 143 }
144 memset(&dummy, 0, sizeof(struct ktermios)); 144 memset(&dummy, 0, sizeof(struct ktermios));
145 tty->termios = termios; 145 tty->termios = termios;
146 port->port.tty = tty; 146 tty_port_tty_set(&port->port, tty);
147 } 147 }
148 148
149 /* only call the device specific open if this 149 /* only call the device specific open if this
@@ -163,7 +163,7 @@ static int usb_console_setup(struct console *co, char *options)
163 tty_termios_encode_baud_rate(termios, baud, baud); 163 tty_termios_encode_baud_rate(termios, baud, baud);
164 serial->type->set_termios(tty, port, &dummy); 164 serial->type->set_termios(tty, port, &dummy);
165 165
166 port->port.tty = NULL; 166 tty_port_tty_set(&port->port, NULL);
167 kfree(termios); 167 kfree(termios);
168 kfree(tty); 168 kfree(tty);
169 } 169 }
@@ -176,7 +176,7 @@ out:
176 return retval; 176 return retval;
177free_termios: 177free_termios:
178 kfree(termios); 178 kfree(termios);
179 port->port.tty = NULL; 179 tty_port_tty_set(&port->port, NULL);
180free_tty: 180free_tty:
181 kfree(tty); 181 kfree(tty);
182reset_open_count: 182reset_open_count:
diff --git a/drivers/usb/serial/cyberjack.c b/drivers/usb/serial/cyberjack.c
index b4d72351cb96..94ef36c4764b 100644
--- a/drivers/usb/serial/cyberjack.c
+++ b/drivers/usb/serial/cyberjack.c
@@ -384,7 +384,7 @@ static void cyberjack_read_bulk_callback(struct urb *urb)
384 return; 384 return;
385 } 385 }
386 386
387 tty = port->port.tty; 387 tty = tty_port_tty_get(&port->port);
388 if (!tty) { 388 if (!tty) {
389 dbg("%s - ignoring since device not open\n", __func__); 389 dbg("%s - ignoring since device not open\n", __func__);
390 return; 390 return;
@@ -394,6 +394,7 @@ static void cyberjack_read_bulk_callback(struct urb *urb)
394 tty_insert_flip_string(tty, data, urb->actual_length); 394 tty_insert_flip_string(tty, data, urb->actual_length);
395 tty_flip_buffer_push(tty); 395 tty_flip_buffer_push(tty);
396 } 396 }
397 tty_kref_put(tty);
397 398
398 spin_lock(&priv->lock); 399 spin_lock(&priv->lock);
399 400
diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
index 22837a3f2f89..f3514a91f915 100644
--- a/drivers/usb/serial/cypress_m8.c
+++ b/drivers/usb/serial/cypress_m8.c
@@ -1286,7 +1286,7 @@ static void cypress_read_int_callback(struct urb *urb)
1286 } 1286 }
1287 spin_unlock_irqrestore(&priv->lock, flags); 1287 spin_unlock_irqrestore(&priv->lock, flags);
1288 1288
1289 tty = port->port.tty; 1289 tty = tty_port_tty_get(&port->port);
1290 if (!tty) { 1290 if (!tty) {
1291 dbg("%s - bad tty pointer - exiting", __func__); 1291 dbg("%s - bad tty pointer - exiting", __func__);
1292 return; 1292 return;
@@ -1362,7 +1362,7 @@ static void cypress_read_int_callback(struct urb *urb)
1362 data[i]); 1362 data[i]);
1363 tty_insert_flip_char(tty, data[i], tty_flag); 1363 tty_insert_flip_char(tty, data[i], tty_flag);
1364 } 1364 }
1365 tty_flip_buffer_push(port->port.tty); 1365 tty_flip_buffer_push(tty);
1366 } 1366 }
1367 1367
1368 spin_lock_irqsave(&priv->lock, flags); 1368 spin_lock_irqsave(&priv->lock, flags);
@@ -1371,6 +1371,7 @@ static void cypress_read_int_callback(struct urb *urb)
1371 spin_unlock_irqrestore(&priv->lock, flags); 1371 spin_unlock_irqrestore(&priv->lock, flags);
1372 1372
1373continue_read: 1373continue_read:
1374 tty_kref_put(tty);
1374 1375
1375 /* Continue trying to always read... unless the port has closed. */ 1376 /* Continue trying to always read... unless the port has closed. */
1376 1377
diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c
index 240aad1acaab..5756ac6d6c92 100644
--- a/drivers/usb/serial/digi_acceleport.c
+++ b/drivers/usb/serial/digi_acceleport.c
@@ -604,7 +604,9 @@ static void digi_wakeup_write_lock(struct work_struct *work)
604 604
605static void digi_wakeup_write(struct usb_serial_port *port) 605static void digi_wakeup_write(struct usb_serial_port *port)
606{ 606{
607 tty_wakeup(port->port.tty); 607 struct tty_struct *tty = tty_port_tty_get(&port->port);
608 tty_wakeup(tty);
609 tty_kref_put(tty);
608} 610}
609 611
610 612
@@ -1668,7 +1670,7 @@ static int digi_read_inb_callback(struct urb *urb)
1668{ 1670{
1669 1671
1670 struct usb_serial_port *port = urb->context; 1672 struct usb_serial_port *port = urb->context;
1671 struct tty_struct *tty = port->port.tty; 1673 struct tty_struct *tty;
1672 struct digi_port *priv = usb_get_serial_port_data(port); 1674 struct digi_port *priv = usb_get_serial_port_data(port);
1673 int opcode = ((unsigned char *)urb->transfer_buffer)[0]; 1675 int opcode = ((unsigned char *)urb->transfer_buffer)[0];
1674 int len = ((unsigned char *)urb->transfer_buffer)[1]; 1676 int len = ((unsigned char *)urb->transfer_buffer)[1];
@@ -1692,6 +1694,7 @@ static int digi_read_inb_callback(struct urb *urb)
1692 return -1; 1694 return -1;
1693 } 1695 }
1694 1696
1697 tty = tty_port_tty_get(&port->port);
1695 spin_lock(&priv->dp_port_lock); 1698 spin_lock(&priv->dp_port_lock);
1696 1699
1697 /* check for throttle; if set, do not resubmit read urb */ 1700 /* check for throttle; if set, do not resubmit read urb */
@@ -1735,6 +1738,7 @@ static int digi_read_inb_callback(struct urb *urb)
1735 } 1738 }
1736 } 1739 }
1737 spin_unlock(&priv->dp_port_lock); 1740 spin_unlock(&priv->dp_port_lock);
1741 tty_kref_put(tty);
1738 1742
1739 if (opcode == DIGI_CMD_RECEIVE_DISABLE) 1743 if (opcode == DIGI_CMD_RECEIVE_DISABLE)
1740 dbg("%s: got RECEIVE_DISABLE", __func__); 1744 dbg("%s: got RECEIVE_DISABLE", __func__);
@@ -1760,6 +1764,7 @@ static int digi_read_oob_callback(struct urb *urb)
1760 1764
1761 struct usb_serial_port *port = urb->context; 1765 struct usb_serial_port *port = urb->context;
1762 struct usb_serial *serial = port->serial; 1766 struct usb_serial *serial = port->serial;
1767 struct tty_struct *tty;
1763 struct digi_port *priv = usb_get_serial_port_data(port); 1768 struct digi_port *priv = usb_get_serial_port_data(port);
1764 int opcode, line, status, val; 1769 int opcode, line, status, val;
1765 int i; 1770 int i;
@@ -1787,10 +1792,11 @@ static int digi_read_oob_callback(struct urb *urb)
1787 if (priv == NULL) 1792 if (priv == NULL)
1788 return -1; 1793 return -1;
1789 1794
1795 tty = tty_port_tty_get(&port->port);
1790 rts = 0; 1796 rts = 0;
1791 if (port->port.count) 1797 if (port->port.count)
1792 rts = port->port.tty->termios->c_cflag & CRTSCTS; 1798 rts = tty->termios->c_cflag & CRTSCTS;
1793 1799
1794 if (opcode == DIGI_CMD_READ_INPUT_SIGNALS) { 1800 if (opcode == DIGI_CMD_READ_INPUT_SIGNALS) {
1795 spin_lock(&priv->dp_port_lock); 1801 spin_lock(&priv->dp_port_lock);
1796 /* convert from digi flags to termiox flags */ 1802 /* convert from digi flags to termiox flags */
@@ -1798,14 +1804,14 @@ static int digi_read_oob_callback(struct urb *urb)
1798 priv->dp_modem_signals |= TIOCM_CTS; 1804 priv->dp_modem_signals |= TIOCM_CTS;
1799 /* port must be open to use tty struct */ 1805 /* port must be open to use tty struct */
1800 if (rts) { 1806 if (rts) {
1801 port->port.tty->hw_stopped = 0; 1807 tty->hw_stopped = 0;
1802 digi_wakeup_write(port); 1808 digi_wakeup_write(port);
1803 } 1809 }
1804 } else { 1810 } else {
1805 priv->dp_modem_signals &= ~TIOCM_CTS; 1811 priv->dp_modem_signals &= ~TIOCM_CTS;
1806 /* port must be open to use tty struct */ 1812 /* port must be open to use tty struct */
1807 if (rts) 1813 if (rts)
1808 port->port.tty->hw_stopped = 1; 1814 tty->hw_stopped = 1;
1809 } 1815 }
1810 if (val & DIGI_READ_INPUT_SIGNALS_DSR) 1816 if (val & DIGI_READ_INPUT_SIGNALS_DSR)
1811 priv->dp_modem_signals |= TIOCM_DSR; 1817 priv->dp_modem_signals |= TIOCM_DSR;
@@ -1830,6 +1836,7 @@ static int digi_read_oob_callback(struct urb *urb)
1830 } else if (opcode == DIGI_CMD_IFLUSH_FIFO) { 1836 } else if (opcode == DIGI_CMD_IFLUSH_FIFO) {
1831 wake_up_interruptible(&priv->dp_flush_wait); 1837 wake_up_interruptible(&priv->dp_flush_wait);
1832 } 1838 }
1839 tty_kref_put(tty);
1833 } 1840 }
1834 return 0; 1841 return 0;
1835 1842
diff --git a/drivers/usb/serial/empeg.c b/drivers/usb/serial/empeg.c
index a6ab5b58d9ca..1072e847280f 100644
--- a/drivers/usb/serial/empeg.c
+++ b/drivers/usb/serial/empeg.c
@@ -33,9 +33,8 @@
33 * Moved MOD_DEC_USE_COUNT to end of empeg_close(). 33 * Moved MOD_DEC_USE_COUNT to end of empeg_close().
34 * 34 *
35 * (12/03/2000) gb 35 * (12/03/2000) gb
36 * Added port->port.tty->ldisc.set_termios(port->port.tty, NULL) to 36 * Added tty->ldisc.set_termios(port, tty, NULL) to empeg_open().
37 * empeg_open(). This notifies the tty driver that the termios have 37 * This notifies the tty driver that the termios have changed.
38 * changed.
39 * 38 *
40 * (11/13/2000) gb 39 * (11/13/2000) gb
41 * Moved tty->low_latency = 1 from empeg_read_bulk_callback() to 40 * Moved tty->low_latency = 1 from empeg_read_bulk_callback() to
@@ -354,7 +353,7 @@ static void empeg_read_bulk_callback(struct urb *urb)
354 353
355 usb_serial_debug_data(debug, &port->dev, __func__, 354 usb_serial_debug_data(debug, &port->dev, __func__,
356 urb->actual_length, data); 355 urb->actual_length, data);
357 tty = port->port.tty; 356 tty = tty_port_tty_get(&port->port);
358 357
359 if (urb->actual_length) { 358 if (urb->actual_length) {
360 tty_buffer_request_room(tty, urb->actual_length); 359 tty_buffer_request_room(tty, urb->actual_length);
@@ -362,6 +361,7 @@ static void empeg_read_bulk_callback(struct urb *urb)
362 tty_flip_buffer_push(tty); 361 tty_flip_buffer_push(tty);
363 bytes_in += urb->actual_length; 362 bytes_in += urb->actual_length;
364 } 363 }
364 tty_kref_put(tty);
365 365
366 /* Continue trying to always read */ 366 /* Continue trying to always read */
367 usb_fill_bulk_urb( 367 usb_fill_bulk_urb(
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 1ac7e802b4b6..c2ac129557aa 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1808,7 +1808,7 @@ static void ftdi_read_bulk_callback(struct urb *urb)
1808 if (port->port.count <= 0) 1808 if (port->port.count <= 0)
1809 return; 1809 return;
1810 1810
1811 tty = port->port.tty; 1811 tty = tty_port_tty_get(&port->port);
1812 if (!tty) { 1812 if (!tty) {
1813 dbg("%s - bad tty pointer - exiting", __func__); 1813 dbg("%s - bad tty pointer - exiting", __func__);
1814 return; 1814 return;
@@ -1817,7 +1817,7 @@ static void ftdi_read_bulk_callback(struct urb *urb)
1817 priv = usb_get_serial_port_data(port); 1817 priv = usb_get_serial_port_data(port);
1818 if (!priv) { 1818 if (!priv) {
1819 dbg("%s - bad port private data pointer - exiting", __func__); 1819 dbg("%s - bad port private data pointer - exiting", __func__);
1820 return; 1820 goto out;
1821 } 1821 }
1822 1822
1823 if (urb != port->read_urb) 1823 if (urb != port->read_urb)
@@ -1827,7 +1827,7 @@ static void ftdi_read_bulk_callback(struct urb *urb)
1827 /* This will happen at close every time so it is a dbg not an 1827 /* This will happen at close every time so it is a dbg not an
1828 err */ 1828 err */
1829 dbg("(this is ok on close) nonzero read bulk status received: %d", status); 1829 dbg("(this is ok on close) nonzero read bulk status received: %d", status);
1830 return; 1830 goto out;
1831 } 1831 }
1832 1832
1833 /* count data bytes, but not status bytes */ 1833 /* count data bytes, but not status bytes */
@@ -1838,7 +1838,8 @@ static void ftdi_read_bulk_callback(struct urb *urb)
1838 spin_unlock_irqrestore(&priv->rx_lock, flags); 1838 spin_unlock_irqrestore(&priv->rx_lock, flags);
1839 1839
1840 ftdi_process_read(&priv->rx_work.work); 1840 ftdi_process_read(&priv->rx_work.work);
1841 1841out:
1842 tty_kref_put(tty);
1842} /* ftdi_read_bulk_callback */ 1843} /* ftdi_read_bulk_callback */
1843 1844
1844 1845
@@ -1863,7 +1864,7 @@ static void ftdi_process_read(struct work_struct *work)
1863 if (port->port.count <= 0) 1864 if (port->port.count <= 0)
1864 return; 1865 return;
1865 1866
1866 tty = port->port.tty; 1867 tty = tty_port_tty_get(&port->port);
1867 if (!tty) { 1868 if (!tty) {
1868 dbg("%s - bad tty pointer - exiting", __func__); 1869 dbg("%s - bad tty pointer - exiting", __func__);
1869 return; 1870 return;
@@ -1872,13 +1873,13 @@ static void ftdi_process_read(struct work_struct *work)
1872 priv = usb_get_serial_port_data(port); 1873 priv = usb_get_serial_port_data(port);
1873 if (!priv) { 1874 if (!priv) {
1874 dbg("%s - bad port private data pointer - exiting", __func__); 1875 dbg("%s - bad port private data pointer - exiting", __func__);
1875 return; 1876 goto out;
1876 } 1877 }
1877 1878
1878 urb = port->read_urb; 1879 urb = port->read_urb;
1879 if (!urb) { 1880 if (!urb) {
1880 dbg("%s - bad read_urb pointer - exiting", __func__); 1881 dbg("%s - bad read_urb pointer - exiting", __func__);
1881 return; 1882 goto out;
1882 } 1883 }
1883 1884
1884 data = urb->transfer_buffer; 1885 data = urb->transfer_buffer;
@@ -2020,7 +2021,7 @@ static void ftdi_process_read(struct work_struct *work)
2020 schedule_delayed_work(&priv->rx_work, 1); 2021 schedule_delayed_work(&priv->rx_work, 1);
2021 else 2022 else
2022 dbg("%s - port is closed", __func__); 2023 dbg("%s - port is closed", __func__);
2023 return; 2024 goto out;
2024 } 2025 }
2025 2026
2026 /* urb is completely processed */ 2027 /* urb is completely processed */
@@ -2041,6 +2042,8 @@ static void ftdi_process_read(struct work_struct *work)
2041 err("%s - failed resubmitting read urb, error %d", 2042 err("%s - failed resubmitting read urb, error %d",
2042 __func__, result); 2043 __func__, result);
2043 } 2044 }
2045out:
2046 tty_kref_put(tty);
2044} /* ftdi_process_read */ 2047} /* ftdi_process_read */
2045 2048
2046 2049
diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
index d95382088075..2ad0569bcf19 100644
--- a/drivers/usb/serial/garmin_gps.c
+++ b/drivers/usb/serial/garmin_gps.c
@@ -276,7 +276,7 @@ static inline int isAbortTrfCmnd(const unsigned char *buf)
276static void send_to_tty(struct usb_serial_port *port, 276static void send_to_tty(struct usb_serial_port *port,
277 char *data, unsigned int actual_length) 277 char *data, unsigned int actual_length)
278{ 278{
279 struct tty_struct *tty = port->port.tty; 279 struct tty_struct *tty = tty_port_tty_get(&port->port);
280 280
281 if (tty && actual_length) { 281 if (tty && actual_length) {
282 282
@@ -287,6 +287,7 @@ static void send_to_tty(struct usb_serial_port *port,
287 tty_insert_flip_string(tty, data, actual_length); 287 tty_insert_flip_string(tty, data, actual_length);
288 tty_flip_buffer_push(tty); 288 tty_flip_buffer_push(tty);
289 } 289 }
290 tty_kref_put(tty);
290} 291}
291 292
292 293
diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
index fe84c88ec20c..814909f1ee63 100644
--- a/drivers/usb/serial/generic.c
+++ b/drivers/usb/serial/generic.c
@@ -330,7 +330,7 @@ static void resubmit_read_urb(struct usb_serial_port *port, gfp_t mem_flags)
330static void flush_and_resubmit_read_urb(struct usb_serial_port *port) 330static void flush_and_resubmit_read_urb(struct usb_serial_port *port)
331{ 331{
332 struct urb *urb = port->read_urb; 332 struct urb *urb = port->read_urb;
333 struct tty_struct *tty = port->port.tty; 333 struct tty_struct *tty = tty_port_tty_get(&port->port);
334 int room; 334 int room;
335 335
336 /* Push data to tty */ 336 /* Push data to tty */
@@ -341,6 +341,7 @@ static void flush_and_resubmit_read_urb(struct usb_serial_port *port)
341 tty_flip_buffer_push(tty); 341 tty_flip_buffer_push(tty);
342 } 342 }
343 } 343 }
344 tty_kref_put(tty);
344 345
345 resubmit_read_urb(port, GFP_ATOMIC); 346 resubmit_read_urb(port, GFP_ATOMIC);
346} 347}
diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
index bfa508ddb0fe..611f97fd62f1 100644
--- a/drivers/usb/serial/io_edgeport.c
+++ b/drivers/usb/serial/io_edgeport.c
@@ -600,6 +600,7 @@ static void edge_interrupt_callback(struct urb *urb)
600 struct edgeport_serial *edge_serial = urb->context; 600 struct edgeport_serial *edge_serial = urb->context;
601 struct edgeport_port *edge_port; 601 struct edgeport_port *edge_port;
602 struct usb_serial_port *port; 602 struct usb_serial_port *port;
603 struct tty_struct *tty;
603 unsigned char *data = urb->transfer_buffer; 604 unsigned char *data = urb->transfer_buffer;
604 int length = urb->actual_length; 605 int length = urb->actual_length;
605 int bytes_avail; 606 int bytes_avail;
@@ -675,9 +676,12 @@ static void edge_interrupt_callback(struct urb *urb)
675 676
676 /* tell the tty driver that something 677 /* tell the tty driver that something
677 has changed */ 678 has changed */
678 if (edge_port->port->port.tty) 679 tty = tty_port_tty_get(
679 tty_wakeup(edge_port->port->port.tty); 680 &edge_port->port->port);
680 681 if (tty) {
682 tty_wakeup(tty);
683 tty_kref_put(tty);
684 }
681 /* Since we have more credit, check 685 /* Since we have more credit, check
682 if more data can be sent */ 686 if more data can be sent */
683 send_more_port_data(edge_serial, 687 send_more_port_data(edge_serial,
@@ -778,13 +782,14 @@ static void edge_bulk_out_data_callback(struct urb *urb)
778 __func__, status); 782 __func__, status);
779 } 783 }
780 784
781 tty = edge_port->port->port.tty; 785 tty = tty_port_tty_get(&edge_port->port->port);
782 786
783 if (tty && edge_port->open) { 787 if (tty && edge_port->open) {
784 /* let the tty driver wakeup if it has a special 788 /* let the tty driver wakeup if it has a special
785 write_wakeup function */ 789 write_wakeup function */
786 tty_wakeup(tty); 790 tty_wakeup(tty);
787 } 791 }
792 tty_kref_put(tty);
788 793
789 /* Release the Write URB */ 794 /* Release the Write URB */
790 edge_port->write_in_progress = false; 795 edge_port->write_in_progress = false;
@@ -826,11 +831,12 @@ static void edge_bulk_out_cmd_callback(struct urb *urb)
826 } 831 }
827 832
828 /* Get pointer to tty */ 833 /* Get pointer to tty */
829 tty = edge_port->port->port.tty; 834 tty = tty_port_tty_get(&edge_port->port->port);
830 835
831 /* tell the tty driver that something has changed */ 836 /* tell the tty driver that something has changed */
832 if (tty && edge_port->open) 837 if (tty && edge_port->open)
833 tty_wakeup(tty); 838 tty_wakeup(tty);
839 tty_kref_put(tty);
834 840
835 /* we have completed the command */ 841 /* we have completed the command */
836 edge_port->commandPending = false; 842 edge_port->commandPending = false;
@@ -1932,11 +1938,13 @@ static void process_rcvd_data(struct edgeport_serial *edge_serial,
1932 edge_serial->rxPort]; 1938 edge_serial->rxPort];
1933 edge_port = usb_get_serial_port_data(port); 1939 edge_port = usb_get_serial_port_data(port);
1934 if (edge_port->open) { 1940 if (edge_port->open) {
1935 tty = edge_port->port->port.tty; 1941 tty = tty_port_tty_get(
1942 &edge_port->port->port);
1936 if (tty) { 1943 if (tty) {
1937 dbg("%s - Sending %d bytes to TTY for port %d", 1944 dbg("%s - Sending %d bytes to TTY for port %d",
1938 __func__, rxLen, edge_serial->rxPort); 1945 __func__, rxLen, edge_serial->rxPort);
1939 edge_tty_recv(&edge_serial->serial->dev->dev, tty, buffer, rxLen); 1946 edge_tty_recv(&edge_serial->serial->dev->dev, tty, buffer, rxLen);
1947 tty_kref_put(tty);
1940 } 1948 }
1941 edge_port->icount.rx += rxLen; 1949 edge_port->icount.rx += rxLen;
1942 } 1950 }
@@ -1971,6 +1979,7 @@ static void process_rcvd_status(struct edgeport_serial *edge_serial,
1971{ 1979{
1972 struct usb_serial_port *port; 1980 struct usb_serial_port *port;
1973 struct edgeport_port *edge_port; 1981 struct edgeport_port *edge_port;
1982 struct tty_struct *tty;
1974 __u8 code = edge_serial->rxStatusCode; 1983 __u8 code = edge_serial->rxStatusCode;
1975 1984
1976 /* switch the port pointer to the one being currently talked about */ 1985 /* switch the port pointer to the one being currently talked about */
@@ -2020,10 +2029,12 @@ static void process_rcvd_status(struct edgeport_serial *edge_serial,
2020 2029
2021 /* send the current line settings to the port so we are 2030 /* send the current line settings to the port so we are
2022 in sync with any further termios calls */ 2031 in sync with any further termios calls */
2023 /* FIXME: locking on tty */ 2032 tty = tty_port_tty_get(&edge_port->port->port);
2024 if (edge_port->port->port.tty) 2033 if (tty) {
2025 change_port_settings(edge_port->port->port.tty, 2034 change_port_settings(tty,
2026 edge_port, edge_port->port->port.tty->termios); 2035 edge_port, tty->termios);
2036 tty_kref_put(tty);
2037 }
2027 2038
2028 /* we have completed the open */ 2039 /* we have completed the open */
2029 edge_port->openPending = false; 2040 edge_port->openPending = false;
@@ -2163,10 +2174,14 @@ static void handle_new_lsr(struct edgeport_port *edge_port, __u8 lsrData,
2163 } 2174 }
2164 2175
2165 /* Place LSR data byte into Rx buffer */ 2176 /* Place LSR data byte into Rx buffer */
2166 if (lsrData && edge_port->port->port.tty) 2177 if (lsrData) {
2167 edge_tty_recv(&edge_port->port->dev, 2178 struct tty_struct *tty =
2168 edge_port->port->port.tty, &data, 1); 2179 tty_port_tty_get(&edge_port->port->port);
2169 2180 if (tty) {
2181 edge_tty_recv(&edge_port->port->dev, tty, &data, 1);
2182 tty_kref_put(tty);
2183 }
2184 }
2170 /* update input line counters */ 2185 /* update input line counters */
2171 icount = &edge_port->icount; 2186 icount = &edge_port->icount;
2172 if (newLsr & LSR_BREAK) 2187 if (newLsr & LSR_BREAK)
diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
index cb4c54316cf5..541dd8e6e7a2 100644
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -572,7 +572,7 @@ static void chase_port(struct edgeport_port *port, unsigned long timeout,
572 int flush) 572 int flush)
573{ 573{
574 int baud_rate; 574 int baud_rate;
575 struct tty_struct *tty = port->port->port.tty; 575 struct tty_struct *tty = tty_port_tty_get(&port->port->port);
576 wait_queue_t wait; 576 wait_queue_t wait;
577 unsigned long flags; 577 unsigned long flags;
578 578
@@ -599,6 +599,7 @@ static void chase_port(struct edgeport_port *port, unsigned long timeout,
599 if (flush) 599 if (flush)
600 edge_buf_clear(port->ep_out_buf); 600 edge_buf_clear(port->ep_out_buf);
601 spin_unlock_irqrestore(&port->ep_lock, flags); 601 spin_unlock_irqrestore(&port->ep_lock, flags);
602 tty_kref_put(tty);
602 603
603 /* wait for data to drain from the device */ 604 /* wait for data to drain from the device */
604 timeout += jiffies; 605 timeout += jiffies;
@@ -1554,7 +1555,7 @@ static void handle_new_msr(struct edgeport_port *edge_port, __u8 msr)
1554 /* Save the new modem status */ 1555 /* Save the new modem status */
1555 edge_port->shadow_msr = msr & 0xf0; 1556 edge_port->shadow_msr = msr & 0xf0;
1556 1557
1557 tty = edge_port->port->port.tty; 1558 tty = tty_port_tty_get(&edge_port->port->port);
1558 /* handle CTS flow control */ 1559 /* handle CTS flow control */
1559 if (tty && C_CRTSCTS(tty)) { 1560 if (tty && C_CRTSCTS(tty)) {
1560 if (msr & EDGEPORT_MSR_CTS) { 1561 if (msr & EDGEPORT_MSR_CTS) {
@@ -1564,6 +1565,7 @@ static void handle_new_msr(struct edgeport_port *edge_port, __u8 msr)
1564 tty->hw_stopped = 1; 1565 tty->hw_stopped = 1;
1565 } 1566 }
1566 } 1567 }
1568 tty_kref_put(tty);
1567 1569
1568 return; 1570 return;
1569} 1571}
@@ -1574,6 +1576,7 @@ static void handle_new_lsr(struct edgeport_port *edge_port, int lsr_data,
1574 struct async_icount *icount; 1576 struct async_icount *icount;
1575 __u8 new_lsr = (__u8)(lsr & (__u8)(LSR_OVER_ERR | LSR_PAR_ERR | 1577 __u8 new_lsr = (__u8)(lsr & (__u8)(LSR_OVER_ERR | LSR_PAR_ERR |
1576 LSR_FRM_ERR | LSR_BREAK)); 1578 LSR_FRM_ERR | LSR_BREAK));
1579 struct tty_struct *tty;
1577 1580
1578 dbg("%s - %02x", __func__, new_lsr); 1581 dbg("%s - %02x", __func__, new_lsr);
1579 1582
@@ -1587,8 +1590,13 @@ static void handle_new_lsr(struct edgeport_port *edge_port, int lsr_data,
1587 new_lsr &= (__u8)(LSR_OVER_ERR | LSR_BREAK); 1590 new_lsr &= (__u8)(LSR_OVER_ERR | LSR_BREAK);
1588 1591
1589 /* Place LSR data byte into Rx buffer */ 1592 /* Place LSR data byte into Rx buffer */
1590 if (lsr_data && edge_port->port->port.tty) 1593 if (lsr_data) {
1591 edge_tty_recv(&edge_port->port->dev, edge_port->port->port.tty, &data, 1); 1594 tty = tty_port_tty_get(&edge_port->port->port);
1595 if (tty) {
1596 edge_tty_recv(&edge_port->port->dev, tty, &data, 1);
1597 tty_kref_put(tty);
1598 }
1599 }
1592 1600
1593 /* update input line counters */ 1601 /* update input line counters */
1594 icount = &edge_port->icount; 1602 icount = &edge_port->icount;
@@ -1749,7 +1757,7 @@ static void edge_bulk_in_callback(struct urb *urb)
1749 ++data; 1757 ++data;
1750 } 1758 }
1751 1759
1752 tty = edge_port->port->port.tty; 1760 tty = tty_port_tty_get(&edge_port->port->port);
1753 if (tty && urb->actual_length) { 1761 if (tty && urb->actual_length) {
1754 usb_serial_debug_data(debug, &edge_port->port->dev, 1762 usb_serial_debug_data(debug, &edge_port->port->dev,
1755 __func__, urb->actual_length, data); 1763 __func__, urb->actual_length, data);
@@ -1761,6 +1769,7 @@ static void edge_bulk_in_callback(struct urb *urb)
1761 urb->actual_length); 1769 urb->actual_length);
1762 edge_port->icount.rx += urb->actual_length; 1770 edge_port->icount.rx += urb->actual_length;
1763 } 1771 }
1772 tty_kref_put(tty);
1764 1773
1765exit: 1774exit:
1766 /* continue read unless stopped */ 1775 /* continue read unless stopped */
@@ -1796,6 +1805,7 @@ static void edge_bulk_out_callback(struct urb *urb)
1796 struct usb_serial_port *port = urb->context; 1805 struct usb_serial_port *port = urb->context;
1797 struct edgeport_port *edge_port = usb_get_serial_port_data(port); 1806 struct edgeport_port *edge_port = usb_get_serial_port_data(port);
1798 int status = urb->status; 1807 int status = urb->status;
1808 struct tty_struct *tty;
1799 1809
1800 dbg("%s - port %d", __func__, port->number); 1810 dbg("%s - port %d", __func__, port->number);
1801 1811
@@ -1818,7 +1828,9 @@ static void edge_bulk_out_callback(struct urb *urb)
1818 } 1828 }
1819 1829
1820 /* send any buffered data */ 1830 /* send any buffered data */
1821 edge_send(port->port.tty); 1831 tty = tty_port_tty_get(&port->port);
1832 edge_send(tty);
1833 tty_kref_put(tty);
1822} 1834}
1823 1835
1824static int edge_open(struct tty_struct *tty, 1836static int edge_open(struct tty_struct *tty,
@@ -1876,7 +1888,7 @@ static int edge_open(struct tty_struct *tty,
1876 1888
1877 /* set up the port settings */ 1889 /* set up the port settings */
1878 if (tty) 1890 if (tty)
1879 edge_set_termios(tty, port, port->port.tty->termios); 1891 edge_set_termios(tty, port, tty->termios);
1880 1892
1881 /* open up the port */ 1893 /* open up the port */
1882 1894
diff --git a/drivers/usb/serial/ipaq.c b/drivers/usb/serial/ipaq.c
index cd9a2e138c8b..2affa9c118b2 100644
--- a/drivers/usb/serial/ipaq.c
+++ b/drivers/usb/serial/ipaq.c
@@ -764,13 +764,14 @@ static void ipaq_read_bulk_callback(struct urb *urb)
764 usb_serial_debug_data(debug, &port->dev, __func__, 764 usb_serial_debug_data(debug, &port->dev, __func__,
765 urb->actual_length, data); 765 urb->actual_length, data);
766 766
767 tty = port->port.tty; 767 tty = tty_port_tty_get(&port->port);
768 if (tty && urb->actual_length) { 768 if (tty && urb->actual_length) {
769 tty_buffer_request_room(tty, urb->actual_length); 769 tty_buffer_request_room(tty, urb->actual_length);
770 tty_insert_flip_string(tty, data, urb->actual_length); 770 tty_insert_flip_string(tty, data, urb->actual_length);
771 tty_flip_buffer_push(tty); 771 tty_flip_buffer_push(tty);
772 bytes_in += urb->actual_length; 772 bytes_in += urb->actual_length;
773 } 773 }
774 tty_kref_put(tty);
774 775
775 /* Continue trying to always read */ 776 /* Continue trying to always read */
776 usb_fill_bulk_urb(port->read_urb, port->serial->dev, 777 usb_fill_bulk_urb(port->read_urb, port->serial->dev,
diff --git a/drivers/usb/serial/ipw.c b/drivers/usb/serial/ipw.c
index a842025b9b57..480cac27d646 100644
--- a/drivers/usb/serial/ipw.c
+++ b/drivers/usb/serial/ipw.c
@@ -170,12 +170,13 @@ static void ipw_read_bulk_callback(struct urb *urb)
170 usb_serial_debug_data(debug, &port->dev, __func__, 170 usb_serial_debug_data(debug, &port->dev, __func__,
171 urb->actual_length, data); 171 urb->actual_length, data);
172 172
173 tty = port->port.tty; 173 tty = tty_port_tty_get(&port->port);
174 if (tty && urb->actual_length) { 174 if (tty && urb->actual_length) {
175 tty_buffer_request_room(tty, urb->actual_length); 175 tty_buffer_request_room(tty, urb->actual_length);
176 tty_insert_flip_string(tty, data, urb->actual_length); 176 tty_insert_flip_string(tty, data, urb->actual_length);
177 tty_flip_buffer_push(tty); 177 tty_flip_buffer_push(tty);
178 } 178 }
179 tty_kref_put(tty);
179 180
180 /* Continue trying to always read */ 181 /* Continue trying to always read */
181 usb_fill_bulk_urb(port->read_urb, port->serial->dev, 182 usb_fill_bulk_urb(port->read_urb, port->serial->dev,
diff --git a/drivers/usb/serial/ir-usb.c b/drivers/usb/serial/ir-usb.c
index e59155c6607d..45d4043e04ab 100644
--- a/drivers/usb/serial/ir-usb.c
+++ b/drivers/usb/serial/ir-usb.c
@@ -465,11 +465,12 @@ static void ir_read_bulk_callback(struct urb *urb)
465 ir_baud = *data & 0x0f; 465 ir_baud = *data & 0x0f;
466 usb_serial_debug_data(debug, &port->dev, __func__, 466 usb_serial_debug_data(debug, &port->dev, __func__,
467 urb->actual_length, data); 467 urb->actual_length, data);
468 tty = port->port.tty; 468 tty = tty_port_tty_get(&port->port);
469 if (tty_buffer_request_room(tty, urb->actual_length - 1)) { 469 if (tty_buffer_request_room(tty, urb->actual_length - 1)) {
470 tty_insert_flip_string(tty, data+1, urb->actual_length - 1); 470 tty_insert_flip_string(tty, data+1, urb->actual_length - 1);
471 tty_flip_buffer_push(tty); 471 tty_flip_buffer_push(tty);
472 } 472 }
473 tty_kref_put(tty);
473 474
474 /* 475 /*
475 * No break here. 476 * No break here.
diff --git a/drivers/usb/serial/iuu_phoenix.c b/drivers/usb/serial/iuu_phoenix.c
index ddff37fa6339..53710aa7eadd 100644
--- a/drivers/usb/serial/iuu_phoenix.c
+++ b/drivers/usb/serial/iuu_phoenix.c
@@ -629,13 +629,14 @@ static void read_buf_callback(struct urb *urb)
629 } 629 }
630 630
631 dbg("%s - %i chars to write", __func__, urb->actual_length); 631 dbg("%s - %i chars to write", __func__, urb->actual_length);
632 tty = port->port.tty; 632 tty = tty_port_tty_get(&port->port);
633 if (data == NULL) 633 if (data == NULL)
634 dbg("%s - data is NULL !!!", __func__); 634 dbg("%s - data is NULL !!!", __func__);
635 if (tty && urb->actual_length && data) { 635 if (tty && urb->actual_length && data) {
636 tty_insert_flip_string(tty, data, urb->actual_length); 636 tty_insert_flip_string(tty, data, urb->actual_length);
637 tty_flip_buffer_push(tty); 637 tty_flip_buffer_push(tty);
638 } 638 }
639 tty_kref_put(tty);
639 iuu_led_activity_on(urb); 640 iuu_led_activity_on(urb);
640} 641}
641 642
diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
index 704716f6f6d3..15447af48691 100644
--- a/drivers/usb/serial/keyspan.c
+++ b/drivers/usb/serial/keyspan.c
@@ -430,7 +430,7 @@ static void usa26_indat_callback(struct urb *urb)
430 } 430 }
431 431
432 port = urb->context; 432 port = urb->context;
433 tty = port->port.tty; 433 tty = tty_port_tty_get(&port->port);
434 if (tty && urb->actual_length) { 434 if (tty && urb->actual_length) {
435 /* 0x80 bit is error flag */ 435 /* 0x80 bit is error flag */
436 if ((data[0] & 0x80) == 0) { 436 if ((data[0] & 0x80) == 0) {
@@ -459,6 +459,7 @@ static void usa26_indat_callback(struct urb *urb)
459 } 459 }
460 tty_flip_buffer_push(tty); 460 tty_flip_buffer_push(tty);
461 } 461 }
462 tty_kref_put(tty);
462 463
463 /* Resubmit urb so we continue receiving */ 464 /* Resubmit urb so we continue receiving */
464 urb->dev = port->serial->dev; 465 urb->dev = port->serial->dev;
@@ -513,6 +514,7 @@ static void usa26_instat_callback(struct urb *urb)
513 struct usb_serial *serial; 514 struct usb_serial *serial;
514 struct usb_serial_port *port; 515 struct usb_serial_port *port;
515 struct keyspan_port_private *p_priv; 516 struct keyspan_port_private *p_priv;
517 struct tty_struct *tty;
516 int old_dcd_state, err; 518 int old_dcd_state, err;
517 int status = urb->status; 519 int status = urb->status;
518 520
@@ -553,12 +555,11 @@ static void usa26_instat_callback(struct urb *urb)
553 p_priv->dcd_state = ((msg->gpia_dcd) ? 1 : 0); 555 p_priv->dcd_state = ((msg->gpia_dcd) ? 1 : 0);
554 p_priv->ri_state = ((msg->ri) ? 1 : 0); 556 p_priv->ri_state = ((msg->ri) ? 1 : 0);
555 557
556 if (port->port.tty && !C_CLOCAL(port->port.tty) 558 if (old_dcd_state != p_priv->dcd_state) {
557 && old_dcd_state != p_priv->dcd_state) { 559 tty = tty_port_tty_get(&port->port);
558 if (old_dcd_state) 560 if (tty && !C_CLOCAL(tty))
559 tty_hangup(port->port.tty); 561 tty_hangup(tty);
560 /* else */ 562 tty_kref_put(tty);
561 /* wake_up_interruptible(&p_priv->open_wait); */
562 } 563 }
563 564
564 /* Resubmit urb so we continue receiving */ 565 /* Resubmit urb so we continue receiving */
@@ -604,11 +605,12 @@ static void usa28_indat_callback(struct urb *urb)
604 p_priv = usb_get_serial_port_data(port); 605 p_priv = usb_get_serial_port_data(port);
605 data = urb->transfer_buffer; 606 data = urb->transfer_buffer;
606 607
607 tty = port->port.tty; 608 tty =tty_port_tty_get(&port->port);
608 if (urb->actual_length) { 609 if (tty && urb->actual_length) {
609 tty_insert_flip_string(tty, data, urb->actual_length); 610 tty_insert_flip_string(tty, data, urb->actual_length);
610 tty_flip_buffer_push(tty); 611 tty_flip_buffer_push(tty);
611 } 612 }
613 tty_kref_put(tty);
612 614
613 /* Resubmit urb so we continue receiving */ 615 /* Resubmit urb so we continue receiving */
614 urb->dev = port->serial->dev; 616 urb->dev = port->serial->dev;
@@ -652,6 +654,7 @@ static void usa28_instat_callback(struct urb *urb)
652 struct usb_serial *serial; 654 struct usb_serial *serial;
653 struct usb_serial_port *port; 655 struct usb_serial_port *port;
654 struct keyspan_port_private *p_priv; 656 struct keyspan_port_private *p_priv;
657 struct tty_struct *tty;
655 int old_dcd_state; 658 int old_dcd_state;
656 int status = urb->status; 659 int status = urb->status;
657 660
@@ -689,12 +692,11 @@ static void usa28_instat_callback(struct urb *urb)
689 p_priv->dcd_state = ((msg->dcd) ? 1 : 0); 692 p_priv->dcd_state = ((msg->dcd) ? 1 : 0);
690 p_priv->ri_state = ((msg->ri) ? 1 : 0); 693 p_priv->ri_state = ((msg->ri) ? 1 : 0);
691 694
692 if (port->port.tty && !C_CLOCAL(port->port.tty) 695 if( old_dcd_state != p_priv->dcd_state && old_dcd_state) {
693 && old_dcd_state != p_priv->dcd_state) { 696 tty = tty_port_tty_get(&port->port);
694 if (old_dcd_state) 697 if (tty && !C_CLOCAL(tty))
695 tty_hangup(port->port.tty); 698 tty_hangup(tty);
696 /* else */ 699 tty_kref_put(tty);
697 /* wake_up_interruptible(&p_priv->open_wait); */
698 } 700 }
699 701
700 /* Resubmit urb so we continue receiving */ 702 /* Resubmit urb so we continue receiving */
@@ -785,12 +787,11 @@ static void usa49_instat_callback(struct urb *urb)
785 p_priv->dcd_state = ((msg->dcd) ? 1 : 0); 787 p_priv->dcd_state = ((msg->dcd) ? 1 : 0);
786 p_priv->ri_state = ((msg->ri) ? 1 : 0); 788 p_priv->ri_state = ((msg->ri) ? 1 : 0);
787 789
788 if (port->port.tty && !C_CLOCAL(port->port.tty) 790 if (old_dcd_state != p_priv->dcd_state && old_dcd_state) {
789 && old_dcd_state != p_priv->dcd_state) { 791 struct tty_struct *tty = tty_port_tty_get(&port->port);
790 if (old_dcd_state) 792 if (tty && !C_CLOCAL(tty))
791 tty_hangup(port->port.tty); 793 tty_hangup(tty);
792 /* else */ 794 tty_kref_put(tty);
793 /* wake_up_interruptible(&p_priv->open_wait); */
794 } 795 }
795 796
796 /* Resubmit urb so we continue receiving */ 797 /* Resubmit urb so we continue receiving */
@@ -827,7 +828,7 @@ static void usa49_indat_callback(struct urb *urb)
827 } 828 }
828 829
829 port = urb->context; 830 port = urb->context;
830 tty = port->port.tty; 831 tty = tty_port_tty_get(&port->port);
831 if (tty && urb->actual_length) { 832 if (tty && urb->actual_length) {
832 /* 0x80 bit is error flag */ 833 /* 0x80 bit is error flag */
833 if ((data[0] & 0x80) == 0) { 834 if ((data[0] & 0x80) == 0) {
@@ -850,6 +851,7 @@ static void usa49_indat_callback(struct urb *urb)
850 } 851 }
851 tty_flip_buffer_push(tty); 852 tty_flip_buffer_push(tty);
852 } 853 }
854 tty_kref_put(tty);
853 855
854 /* Resubmit urb so we continue receiving */ 856 /* Resubmit urb so we continue receiving */
855 urb->dev = port->serial->dev; 857 urb->dev = port->serial->dev;
@@ -893,7 +895,7 @@ static void usa49wg_indat_callback(struct urb *urb)
893 return; 895 return;
894 } 896 }
895 port = serial->port[data[i++]]; 897 port = serial->port[data[i++]];
896 tty = port->port.tty; 898 tty = tty_port_tty_get(&port->port);
897 len = data[i++]; 899 len = data[i++];
898 900
899 /* 0x80 bit is error flag */ 901 /* 0x80 bit is error flag */
@@ -927,6 +929,7 @@ static void usa49wg_indat_callback(struct urb *urb)
927 } 929 }
928 if (port->port.count) 930 if (port->port.count)
929 tty_flip_buffer_push(tty); 931 tty_flip_buffer_push(tty);
932 tty_kref_put(tty);
930 } 933 }
931 } 934 }
932 935
@@ -967,8 +970,8 @@ static void usa90_indat_callback(struct urb *urb)
967 port = urb->context; 970 port = urb->context;
968 p_priv = usb_get_serial_port_data(port); 971 p_priv = usb_get_serial_port_data(port);
969 972
970 tty = port->port.tty;
971 if (urb->actual_length) { 973 if (urb->actual_length) {
974 tty = tty_port_tty_get(&port->port);
972 /* if current mode is DMA, looks like usa28 format 975 /* if current mode is DMA, looks like usa28 format
973 otherwise looks like usa26 data format */ 976 otherwise looks like usa26 data format */
974 977
@@ -1004,6 +1007,7 @@ static void usa90_indat_callback(struct urb *urb)
1004 } 1007 }
1005 } 1008 }
1006 tty_flip_buffer_push(tty); 1009 tty_flip_buffer_push(tty);
1010 tty_kref_put(tty);
1007 } 1011 }
1008 1012
1009 /* Resubmit urb so we continue receiving */ 1013 /* Resubmit urb so we continue receiving */
@@ -1025,6 +1029,7 @@ static void usa90_instat_callback(struct urb *urb)
1025 struct usb_serial *serial; 1029 struct usb_serial *serial;
1026 struct usb_serial_port *port; 1030 struct usb_serial_port *port;
1027 struct keyspan_port_private *p_priv; 1031 struct keyspan_port_private *p_priv;
1032 struct tty_struct *tty;
1028 int old_dcd_state, err; 1033 int old_dcd_state, err;
1029 int status = urb->status; 1034 int status = urb->status;
1030 1035
@@ -1053,12 +1058,11 @@ static void usa90_instat_callback(struct urb *urb)
1053 p_priv->dcd_state = ((msg->dcd) ? 1 : 0); 1058 p_priv->dcd_state = ((msg->dcd) ? 1 : 0);
1054 p_priv->ri_state = ((msg->ri) ? 1 : 0); 1059 p_priv->ri_state = ((msg->ri) ? 1 : 0);
1055 1060
1056 if (port->port.tty && !C_CLOCAL(port->port.tty) 1061 if (old_dcd_state != p_priv->dcd_state && old_dcd_state) {
1057 && old_dcd_state != p_priv->dcd_state) { 1062 tty = tty_port_tty_get(&port->port);
1058 if (old_dcd_state) 1063 if (tty && !C_CLOCAL(tty))
1059 tty_hangup(port->port.tty); 1064 tty_hangup(tty);
1060 /* else */ 1065 tty_kref_put(tty);
1061 /* wake_up_interruptible(&p_priv->open_wait); */
1062 } 1066 }
1063 1067
1064 /* Resubmit urb so we continue receiving */ 1068 /* Resubmit urb so we continue receiving */
@@ -1130,12 +1134,11 @@ static void usa67_instat_callback(struct urb *urb)
1130 p_priv->cts_state = ((msg->hskia_cts) ? 1 : 0); 1134 p_priv->cts_state = ((msg->hskia_cts) ? 1 : 0);
1131 p_priv->dcd_state = ((msg->gpia_dcd) ? 1 : 0); 1135 p_priv->dcd_state = ((msg->gpia_dcd) ? 1 : 0);
1132 1136
1133 if (port->port.tty && !C_CLOCAL(port->port.tty) 1137 if (old_dcd_state != p_priv->dcd_state && old_dcd_state) {
1134 && old_dcd_state != p_priv->dcd_state) { 1138 struct tty_struct *tty = tty_port_tty_get(&port->port);
1135 if (old_dcd_state) 1139 if (tty && !C_CLOCAL(tty))
1136 tty_hangup(port->port.tty); 1140 tty_hangup(tty);
1137 /* else */ 1141 tty_kref_put(tty);
1138 /* wake_up_interruptible(&p_priv->open_wait); */
1139 } 1142 }
1140 1143
1141 /* Resubmit urb so we continue receiving */ 1144 /* Resubmit urb so we continue receiving */
@@ -1332,7 +1335,7 @@ static void keyspan_close(struct tty_struct *tty,
1332 stop_urb(p_priv->out_urbs[i]); 1335 stop_urb(p_priv->out_urbs[i]);
1333 } 1336 }
1334 } 1337 }
1335 port->port.tty = NULL; 1338 tty_port_tty_set(&port->port, NULL);
1336} 1339}
1337 1340
1338/* download the firmware to a pre-renumeration device */ 1341/* download the firmware to a pre-renumeration device */
diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c
index 040040a267d9..99e9a14c5bf6 100644
--- a/drivers/usb/serial/keyspan_pda.c
+++ b/drivers/usb/serial/keyspan_pda.c
@@ -172,8 +172,9 @@ static void keyspan_pda_wakeup_write(struct work_struct *work)
172 struct keyspan_pda_private *priv = 172 struct keyspan_pda_private *priv =
173 container_of(work, struct keyspan_pda_private, wakeup_work); 173 container_of(work, struct keyspan_pda_private, wakeup_work);
174 struct usb_serial_port *port = priv->port; 174 struct usb_serial_port *port = priv->port;
175 175 struct tty_struct *tty = tty_port_tty_get(&port->port);
176 tty_wakeup(port->port.tty); 176 tty_wakeup(tty);
177 tty_kref_put(tty);
177} 178}
178 179
179static void keyspan_pda_request_unthrottle(struct work_struct *work) 180static void keyspan_pda_request_unthrottle(struct work_struct *work)
@@ -205,7 +206,7 @@ static void keyspan_pda_request_unthrottle(struct work_struct *work)
205static void keyspan_pda_rx_interrupt(struct urb *urb) 206static void keyspan_pda_rx_interrupt(struct urb *urb)
206{ 207{
207 struct usb_serial_port *port = urb->context; 208 struct usb_serial_port *port = urb->context;
208 struct tty_struct *tty = port->port.tty; 209 struct tty_struct *tty = tty_port_tty_get(&port->port);
209 unsigned char *data = urb->transfer_buffer; 210 unsigned char *data = urb->transfer_buffer;
210 int retval; 211 int retval;
211 int status = urb->status; 212 int status = urb->status;
@@ -222,7 +223,7 @@ static void keyspan_pda_rx_interrupt(struct urb *urb)
222 /* this urb is terminated, clean up */ 223 /* this urb is terminated, clean up */
223 dbg("%s - urb shutting down with status: %d", 224 dbg("%s - urb shutting down with status: %d",
224 __func__, status); 225 __func__, status);
225 return; 226 goto out;
226 default: 227 default:
227 dbg("%s - nonzero urb status received: %d", 228 dbg("%s - nonzero urb status received: %d",
228 __func__, status); 229 __func__, status);
@@ -261,8 +262,11 @@ static void keyspan_pda_rx_interrupt(struct urb *urb)
261exit: 262exit:
262 retval = usb_submit_urb(urb, GFP_ATOMIC); 263 retval = usb_submit_urb(urb, GFP_ATOMIC);
263 if (retval) 264 if (retval)
264 err("%s - usb_submit_urb failed with result %d", 265 dev_err(&port->dev,
265 __func__, retval); 266 "%s - usb_submit_urb failed with result %d",
267 __func__, retval);
268out:
269 tty_kref_put(tty);
266} 270}
267 271
268 272
diff --git a/drivers/usb/serial/kl5kusb105.c b/drivers/usb/serial/kl5kusb105.c
index b84dddc71124..ff3a07f5102f 100644
--- a/drivers/usb/serial/kl5kusb105.c
+++ b/drivers/usb/serial/kl5kusb105.c
@@ -658,7 +658,7 @@ static void klsi_105_read_bulk_callback(struct urb *urb)
658 } else { 658 } else {
659 int bytes_sent = ((__u8 *) data)[0] + 659 int bytes_sent = ((__u8 *) data)[0] +
660 ((unsigned int) ((__u8 *) data)[1] << 8); 660 ((unsigned int) ((__u8 *) data)[1] << 8);
661 tty = port->port.tty; 661 tty = tty_port_tty_get(&port->port);
662 /* we should immediately resubmit the URB, before attempting 662 /* we should immediately resubmit the URB, before attempting
663 * to pass the data on to the tty layer. But that needs locking 663 * to pass the data on to the tty layer. But that needs locking
664 * against re-entry an then mixed-up data because of 664 * against re-entry an then mixed-up data because of
@@ -679,6 +679,7 @@ static void klsi_105_read_bulk_callback(struct urb *urb)
679 tty_buffer_request_room(tty, bytes_sent); 679 tty_buffer_request_room(tty, bytes_sent);
680 tty_insert_flip_string(tty, data + 2, bytes_sent); 680 tty_insert_flip_string(tty, data + 2, bytes_sent);
681 tty_flip_buffer_push(tty); 681 tty_flip_buffer_push(tty);
682 tty_kref_put(tty);
682 683
683 /* again lockless, but debug info only */ 684 /* again lockless, but debug info only */
684 priv->bytes_in += bytes_sent; 685 priv->bytes_in += bytes_sent;
diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c
index deba28ec77e8..cfcf37c2b957 100644
--- a/drivers/usb/serial/kobil_sct.c
+++ b/drivers/usb/serial/kobil_sct.c
@@ -383,7 +383,7 @@ static void kobil_read_int_callback(struct urb *urb)
383 return; 383 return;
384 } 384 }
385 385
386 tty = port->port.tty; 386 tty = tty_port_tty_get(&port->port);
387 if (urb->actual_length) { 387 if (urb->actual_length) {
388 388
389 /* BEGIN DEBUG */ 389 /* BEGIN DEBUG */
@@ -405,6 +405,7 @@ static void kobil_read_int_callback(struct urb *urb)
405 tty_insert_flip_string(tty, data, urb->actual_length); 405 tty_insert_flip_string(tty, data, urb->actual_length);
406 tty_flip_buffer_push(tty); 406 tty_flip_buffer_push(tty);
407 } 407 }
408 tty_kref_put(tty);
408 /* someone sets the dev to 0 if the close method has been called */ 409 /* someone sets the dev to 0 if the close method has been called */
409 port->interrupt_in_urb->dev = port->serial->dev; 410 port->interrupt_in_urb->dev = port->serial->dev;
410 411
diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
index 0ded8bd6ec85..9b2cef81cde0 100644
--- a/drivers/usb/serial/mct_u232.c
+++ b/drivers/usb/serial/mct_u232.c
@@ -563,10 +563,11 @@ static void mct_u232_read_int_callback(struct urb *urb)
563 * Work-a-round: handle the 'usual' bulk-in pipe here 563 * Work-a-round: handle the 'usual' bulk-in pipe here
564 */ 564 */
565 if (urb->transfer_buffer_length > 2) { 565 if (urb->transfer_buffer_length > 2) {
566 tty = port->port.tty; 566 tty = tty_port_tty_get(&port->port);
567 if (urb->actual_length) { 567 if (urb->actual_length) {
568 tty_insert_flip_string(tty, data, urb->actual_length); 568 tty_insert_flip_string(tty, data, urb->actual_length);
569 tty_flip_buffer_push(tty); 569 tty_flip_buffer_push(tty);
570 tty_kref_put(tty);
570 } 571 }
571 goto exit; 572 goto exit;
572 } 573 }
@@ -591,7 +592,7 @@ static void mct_u232_read_int_callback(struct urb *urb)
591 * to look in to this before committing any code. 592 * to look in to this before committing any code.
592 */ 593 */
593 if (priv->last_lsr & MCT_U232_LSR_ERR) { 594 if (priv->last_lsr & MCT_U232_LSR_ERR) {
594 tty = port->port.tty; 595 tty = tty_port_tty_get(&port->port);
595 /* Overrun Error */ 596 /* Overrun Error */
596 if (priv->last_lsr & MCT_U232_LSR_OE) { 597 if (priv->last_lsr & MCT_U232_LSR_OE) {
597 } 598 }
@@ -604,6 +605,7 @@ static void mct_u232_read_int_callback(struct urb *urb)
604 /* Break Indicator */ 605 /* Break Indicator */
605 if (priv->last_lsr & MCT_U232_LSR_BI) { 606 if (priv->last_lsr & MCT_U232_LSR_BI) {
606 } 607 }
608 tty_kref_put(tty);
607 } 609 }
608#endif 610#endif
609 spin_unlock_irqrestore(&priv->lock, flags); 611 spin_unlock_irqrestore(&priv->lock, flags);
diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index 7c4917d77c0a..7b538caec37f 100644
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -216,12 +216,13 @@ static void mos7720_bulk_in_callback(struct urb *urb)
216 216
217 data = urb->transfer_buffer; 217 data = urb->transfer_buffer;
218 218
219 tty = port->port.tty; 219 tty = tty_port_tty_get(&port->port);
220 if (tty && urb->actual_length) { 220 if (tty && urb->actual_length) {
221 tty_buffer_request_room(tty, urb->actual_length); 221 tty_buffer_request_room(tty, urb->actual_length);
222 tty_insert_flip_string(tty, data, urb->actual_length); 222 tty_insert_flip_string(tty, data, urb->actual_length);
223 tty_flip_buffer_push(tty); 223 tty_flip_buffer_push(tty);
224 } 224 }
225 tty_kref_put(tty);
225 226
226 if (!port->read_urb) { 227 if (!port->read_urb) {
227 dbg("URB KILLED !!!"); 228 dbg("URB KILLED !!!");
@@ -262,10 +263,11 @@ static void mos7720_bulk_out_data_callback(struct urb *urb)
262 263
263 dbg("Entering ........."); 264 dbg("Entering .........");
264 265
265 tty = mos7720_port->port->port.tty; 266 tty = tty_port_tty_get(&mos7720_port->port->port);
266 267
267 if (tty && mos7720_port->open) 268 if (tty && mos7720_port->open)
268 tty_wakeup(tty); 269 tty_wakeup(tty);
270 tty_kref_put(tty);
269} 271}
270 272
271/* 273/*
@@ -1267,29 +1269,6 @@ static int get_lsr_info(struct tty_struct *tty,
1267 return 0; 1269 return 0;
1268} 1270}
1269 1271
1270/*
1271 * get_number_bytes_avail - get number of bytes available
1272 *
1273 * Purpose: Let user call ioctl to get the count of number of bytes available.
1274 */
1275static int get_number_bytes_avail(struct moschip_port *mos7720_port,
1276 unsigned int __user *value)
1277{
1278 unsigned int result = 0;
1279 struct tty_struct *tty = mos7720_port->port->port.tty;
1280
1281 if (!tty)
1282 return -ENOIOCTLCMD;
1283
1284 result = tty->read_cnt;
1285
1286 dbg("%s(%d) = %d", __func__, mos7720_port->port->number, result);
1287 if (copy_to_user(value, &result, sizeof(int)))
1288 return -EFAULT;
1289
1290 return -ENOIOCTLCMD;
1291}
1292
1293static int set_modem_info(struct moschip_port *mos7720_port, unsigned int cmd, 1272static int set_modem_info(struct moschip_port *mos7720_port, unsigned int cmd,
1294 unsigned int __user *value) 1273 unsigned int __user *value)
1295{ 1274{
@@ -1409,13 +1388,6 @@ static int mos7720_ioctl(struct tty_struct *tty, struct file *file,
1409 dbg("%s - port %d, cmd = 0x%x", __func__, port->number, cmd); 1388 dbg("%s - port %d, cmd = 0x%x", __func__, port->number, cmd);
1410 1389
1411 switch (cmd) { 1390 switch (cmd) {
1412 case TIOCINQ:
1413 /* return number of bytes available */
1414 dbg("%s (%d) TIOCINQ", __func__, port->number);
1415 return get_number_bytes_avail(mos7720_port,
1416 (unsigned int __user *)arg);
1417 break;
1418
1419 case TIOCSERGETLSR: 1391 case TIOCSERGETLSR:
1420 dbg("%s (%d) TIOCSERGETLSR", __func__, port->number); 1392 dbg("%s (%d) TIOCSERGETLSR", __func__, port->number);
1421 return get_lsr_info(tty, mos7720_port, 1393 return get_lsr_info(tty, mos7720_port,
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
index 09d82062b973..60543d79ef56 100644
--- a/drivers/usb/serial/mos7840.c
+++ b/drivers/usb/serial/mos7840.c
@@ -709,12 +709,13 @@ static void mos7840_bulk_in_callback(struct urb *urb)
709 dbg("%s", "Entering ........... \n"); 709 dbg("%s", "Entering ........... \n");
710 710
711 if (urb->actual_length) { 711 if (urb->actual_length) {
712 tty = mos7840_port->port->port.tty; 712 tty = tty_port_tty_get(&mos7840_port->port->port);
713 if (tty) { 713 if (tty) {
714 tty_buffer_request_room(tty, urb->actual_length); 714 tty_buffer_request_room(tty, urb->actual_length);
715 tty_insert_flip_string(tty, data, urb->actual_length); 715 tty_insert_flip_string(tty, data, urb->actual_length);
716 dbg(" %s \n", data); 716 dbg(" %s \n", data);
717 tty_flip_buffer_push(tty); 717 tty_flip_buffer_push(tty);
718 tty_kref_put(tty);
718 } 719 }
719 mos7840_port->icount.rx += urb->actual_length; 720 mos7840_port->icount.rx += urb->actual_length;
720 smp_wmb(); 721 smp_wmb();
@@ -773,10 +774,10 @@ static void mos7840_bulk_out_data_callback(struct urb *urb)
773 774
774 dbg("%s \n", "Entering ........."); 775 dbg("%s \n", "Entering .........");
775 776
776 tty = mos7840_port->port->port.tty; 777 tty = tty_port_tty_get(&mos7840_port->port->port);
777
778 if (tty && mos7840_port->open) 778 if (tty && mos7840_port->open)
779 tty_wakeup(tty); 779 tty_wakeup(tty);
780 tty_kref_put(tty);
780 781
781} 782}
782 783
diff --git a/drivers/usb/serial/navman.c b/drivers/usb/serial/navman.c
index d6736531a0fa..bcdcbb822705 100644
--- a/drivers/usb/serial/navman.c
+++ b/drivers/usb/serial/navman.c
@@ -64,12 +64,13 @@ static void navman_read_int_callback(struct urb *urb)
64 usb_serial_debug_data(debug, &port->dev, __func__, 64 usb_serial_debug_data(debug, &port->dev, __func__,
65 urb->actual_length, data); 65 urb->actual_length, data);
66 66
67 tty = port->port.tty; 67 tty = tty_port_tty_get(&port->port);
68 if (tty && urb->actual_length) { 68 if (tty && urb->actual_length) {
69 tty_buffer_request_room(tty, urb->actual_length); 69 tty_buffer_request_room(tty, urb->actual_length);
70 tty_insert_flip_string(tty, data, urb->actual_length); 70 tty_insert_flip_string(tty, data, urb->actual_length);
71 tty_flip_buffer_push(tty); 71 tty_flip_buffer_push(tty);
72 } 72 }
73 tty_kref_put(tty);
73 74
74exit: 75exit:
75 result = usb_submit_urb(urb, GFP_ATOMIC); 76 result = usb_submit_urb(urb, GFP_ATOMIC);
diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c
index ae8e227f3db2..c4d70b0f1e48 100644
--- a/drivers/usb/serial/omninet.c
+++ b/drivers/usb/serial/omninet.c
@@ -172,7 +172,7 @@ static int omninet_open(struct tty_struct *tty,
172 dbg("%s - port %d", __func__, port->number); 172 dbg("%s - port %d", __func__, port->number);
173 173
174 wport = serial->port[1]; 174 wport = serial->port[1];
175 wport->port.tty = tty; /* FIXME */ 175 tty_port_tty_set(&wport->port, tty);
176 176
177 /* Start reading from the device */ 177 /* Start reading from the device */
178 usb_fill_bulk_urb(port->read_urb, serial->dev, 178 usb_fill_bulk_urb(port->read_urb, serial->dev,
@@ -229,9 +229,11 @@ static void omninet_read_bulk_callback(struct urb *urb)
229 } 229 }
230 230
231 if (urb->actual_length && header->oh_len) { 231 if (urb->actual_length && header->oh_len) {
232 tty_insert_flip_string(port->port.tty, 232 struct tty_struct *tty = tty_port_tty_get(&port->port);
233 data + OMNINET_DATAOFFSET, header->oh_len); 233 tty_insert_flip_string(tty, data + OMNINET_DATAOFFSET,
234 tty_flip_buffer_push(port->port.tty); 234 header->oh_len);
235 tty_flip_buffer_push(tty);
236 tty_kref_put(tty);
235 } 237 }
236 238
237 /* Continue trying to always read */ 239 /* Continue trying to always read */
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 73f8277f88f2..6b1727e751e3 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -571,14 +571,14 @@ static void option_indat_callback(struct urb *urb)
571 dbg("%s: nonzero status: %d on endpoint %02x.", 571 dbg("%s: nonzero status: %d on endpoint %02x.",
572 __func__, status, endpoint); 572 __func__, status, endpoint);
573 } else { 573 } else {
574 tty = port->port.tty; 574 tty = tty_port_tty_get(&port->port);
575 if (urb->actual_length) { 575 if (urb->actual_length) {
576 tty_buffer_request_room(tty, urb->actual_length); 576 tty_buffer_request_room(tty, urb->actual_length);
577 tty_insert_flip_string(tty, data, urb->actual_length); 577 tty_insert_flip_string(tty, data, urb->actual_length);
578 tty_flip_buffer_push(tty); 578 tty_flip_buffer_push(tty);
579 } else { 579 } else
580 dbg("%s: empty read urb received", __func__); 580 dbg("%s: empty read urb received", __func__);
581 } 581 tty_kref_put(tty);
582 582
583 /* Resubmit urb so we continue receiving */ 583 /* Resubmit urb so we continue receiving */
584 if (port->port.count && status != -ESHUTDOWN) { 584 if (port->port.count && status != -ESHUTDOWN) {
@@ -647,9 +647,13 @@ static void option_instat_callback(struct urb *urb)
647 portdata->dsr_state = ((signals & 0x02) ? 1 : 0); 647 portdata->dsr_state = ((signals & 0x02) ? 1 : 0);
648 portdata->ri_state = ((signals & 0x08) ? 1 : 0); 648 portdata->ri_state = ((signals & 0x08) ? 1 : 0);
649 649
650 if (port->port.tty && !C_CLOCAL(port->port.tty) && 650 if (old_dcd_state && !portdata->dcd_state) {
651 old_dcd_state && !portdata->dcd_state) 651 struct tty_struct *tty =
652 tty_hangup(port->port.tty); 652 tty_port_tty_get(&port->port);
653 if (tty && !C_CLOCAL(tty))
654 tty_hangup(tty);
655 tty_kref_put(tty);
656 }
653 } else { 657 } else {
654 dbg("%s: type %x req %x", __func__, 658 dbg("%s: type %x req %x", __func__,
655 req_pkt->bRequestType, req_pkt->bRequest); 659 req_pkt->bRequestType, req_pkt->bRequest);
@@ -793,7 +797,7 @@ static void option_close(struct tty_struct *tty,
793 for (i = 0; i < N_OUT_URB; i++) 797 for (i = 0; i < N_OUT_URB; i++)
794 usb_kill_urb(portdata->out_urbs[i]); 798 usb_kill_urb(portdata->out_urbs[i]);
795 } 799 }
796 port->port.tty = NULL; /* FIXME */ 800 tty_port_tty_set(&port->port, NULL);
797} 801}
798 802
799/* Helper functions used by option_setup_urbs */ 803/* Helper functions used by option_setup_urbs */
diff --git a/drivers/usb/serial/oti6858.c b/drivers/usb/serial/oti6858.c
index 42f92815c6e5..ba551f00f16f 100644
--- a/drivers/usb/serial/oti6858.c
+++ b/drivers/usb/serial/oti6858.c
@@ -998,11 +998,12 @@ static void oti6858_read_bulk_callback(struct urb *urb)
998 return; 998 return;
999 } 999 }
1000 1000
1001 tty = port->port.tty; 1001 tty = tty_port_tty_get(&port->port);
1002 if (tty != NULL && urb->actual_length > 0) { 1002 if (tty != NULL && urb->actual_length > 0) {
1003 tty_insert_flip_string(tty, data, urb->actual_length); 1003 tty_insert_flip_string(tty, data, urb->actual_length);
1004 tty_flip_buffer_push(tty); 1004 tty_flip_buffer_push(tty);
1005 } 1005 }
1006 tty_kref_put(tty);
1006 1007
1007 /* schedule the interrupt urb if we are still open */ 1008 /* schedule the interrupt urb if we are still open */
1008 if (port->port.count != 0) { 1009 if (port->port.count != 0) {
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 8d6006894bf5..908437847165 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -1046,7 +1046,7 @@ static void pl2303_read_bulk_callback(struct urb *urb)
1046 tty_flag = TTY_FRAME; 1046 tty_flag = TTY_FRAME;
1047 dbg("%s - tty_flag = %d", __func__, tty_flag); 1047 dbg("%s - tty_flag = %d", __func__, tty_flag);
1048 1048
1049 tty = port->port.tty; 1049 tty = tty_port_tty_get(&port->port);
1050 if (tty && urb->actual_length) { 1050 if (tty && urb->actual_length) {
1051 tty_buffer_request_room(tty, urb->actual_length + 1); 1051 tty_buffer_request_room(tty, urb->actual_length + 1);
1052 /* overrun is special, not associated with a char */ 1052 /* overrun is special, not associated with a char */
@@ -1056,7 +1056,7 @@ static void pl2303_read_bulk_callback(struct urb *urb)
1056 tty_insert_flip_char(tty, data[i], tty_flag); 1056 tty_insert_flip_char(tty, data[i], tty_flag);
1057 tty_flip_buffer_push(tty); 1057 tty_flip_buffer_push(tty);
1058 } 1058 }
1059 1059 tty_kref_put(tty);
1060 /* Schedule the next read _if_ we are still open */ 1060 /* Schedule the next read _if_ we are still open */
1061 if (port->port.count) { 1061 if (port->port.count) {
1062 urb->dev = port->serial->dev; 1062 urb->dev = port->serial->dev;
diff --git a/drivers/usb/serial/safe_serial.c b/drivers/usb/serial/safe_serial.c
index def52d07a4ea..72903ac9f5c0 100644
--- a/drivers/usb/serial/safe_serial.c
+++ b/drivers/usb/serial/safe_serial.c
@@ -217,6 +217,7 @@ static void safe_read_bulk_callback(struct urb *urb)
217 struct usb_serial_port *port = urb->context; 217 struct usb_serial_port *port = urb->context;
218 unsigned char *data = urb->transfer_buffer; 218 unsigned char *data = urb->transfer_buffer;
219 unsigned char length = urb->actual_length; 219 unsigned char length = urb->actual_length;
220 struct tty_struct *tty;
220 int result; 221 int result;
221 int status = urb->status; 222 int status = urb->status;
222 223
@@ -242,6 +243,7 @@ static void safe_read_bulk_callback(struct urb *urb)
242 printk("\n"); 243 printk("\n");
243 } 244 }
244#endif 245#endif
246 tty = tty_port_tty_get(&port->port);
245 if (safe) { 247 if (safe) {
246 __u16 fcs; 248 __u16 fcs;
247 fcs = fcs_compute10(data, length, CRC10_INITFCS); 249 fcs = fcs_compute10(data, length, CRC10_INITFCS);
@@ -250,9 +252,9 @@ static void safe_read_bulk_callback(struct urb *urb)
250 if (actual_length <= (length - 2)) { 252 if (actual_length <= (length - 2)) {
251 info("%s - actual: %d", __func__, 253 info("%s - actual: %d", __func__,
252 actual_length); 254 actual_length);
253 tty_insert_flip_string(port->port.tty, 255 tty_insert_flip_string(tty,
254 data, actual_length); 256 data, actual_length);
255 tty_flip_buffer_push(port->port.tty); 257 tty_flip_buffer_push(tty);
256 } else { 258 } else {
257 err("%s - inconsistent lengths %d:%d", 259 err("%s - inconsistent lengths %d:%d",
258 __func__, actual_length, length); 260 __func__, actual_length, length);
@@ -261,9 +263,10 @@ static void safe_read_bulk_callback(struct urb *urb)
261 err("%s - bad CRC %x", __func__, fcs); 263 err("%s - bad CRC %x", __func__, fcs);
262 } 264 }
263 } else { 265 } else {
264 tty_insert_flip_string(port->port.tty, data, length); 266 tty_insert_flip_string(tty, data, length);
265 tty_flip_buffer_push(port->port.tty); 267 tty_flip_buffer_push(tty);
266 } 268 }
269 tty_kref_put(tty);
267 270
268 /* Continue trying to always read */ 271 /* Continue trying to always read */
269 usb_fill_bulk_urb(urb, port->serial->dev, 272 usb_fill_bulk_urb(urb, port->serial->dev,
diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index ea1a103c99be..8b9eaf383679 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -440,14 +440,14 @@ static void sierra_indat_callback(struct urb *urb)
440 dbg("%s: nonzero status: %d on endpoint %02x.", 440 dbg("%s: nonzero status: %d on endpoint %02x.",
441 __func__, status, endpoint); 441 __func__, status, endpoint);
442 } else { 442 } else {
443 tty = port->port.tty;
444 if (urb->actual_length) { 443 if (urb->actual_length) {
444 tty = tty_port_tty_get(&port->port);
445 tty_buffer_request_room(tty, urb->actual_length); 445 tty_buffer_request_room(tty, urb->actual_length);
446 tty_insert_flip_string(tty, data, urb->actual_length); 446 tty_insert_flip_string(tty, data, urb->actual_length);
447 tty_flip_buffer_push(tty); 447 tty_flip_buffer_push(tty);
448 } else { 448 tty_kref_put(tty);
449 } else
449 dbg("%s: empty read urb received", __func__); 450 dbg("%s: empty read urb received", __func__);
450 }
451 451
452 /* Resubmit urb so we continue receiving */ 452 /* Resubmit urb so we continue receiving */
453 if (port->port.count && status != -ESHUTDOWN) { 453 if (port->port.count && status != -ESHUTDOWN) {
@@ -485,6 +485,7 @@ static void sierra_instat_callback(struct urb *urb)
485 unsigned char signals = *((unsigned char *) 485 unsigned char signals = *((unsigned char *)
486 urb->transfer_buffer + 486 urb->transfer_buffer +
487 sizeof(struct usb_ctrlrequest)); 487 sizeof(struct usb_ctrlrequest));
488 struct tty_struct *tty;
488 489
489 dbg("%s: signal x%x", __func__, signals); 490 dbg("%s: signal x%x", __func__, signals);
490 491
@@ -494,9 +495,11 @@ static void sierra_instat_callback(struct urb *urb)
494 portdata->dsr_state = ((signals & 0x02) ? 1 : 0); 495 portdata->dsr_state = ((signals & 0x02) ? 1 : 0);
495 portdata->ri_state = ((signals & 0x08) ? 1 : 0); 496 portdata->ri_state = ((signals & 0x08) ? 1 : 0);
496 497
497 if (port->port.tty && !C_CLOCAL(port->port.tty) && 498 tty = tty_port_tty_get(&port->port);
499 if (tty && !C_CLOCAL(tty) &&
498 old_dcd_state && !portdata->dcd_state) 500 old_dcd_state && !portdata->dcd_state)
499 tty_hangup(port->port.tty); 501 tty_hangup(tty);
502 tty_kref_put(tty);
500 } else { 503 } else {
501 dbg("%s: type %x req %x", __func__, 504 dbg("%s: type %x req %x", __func__,
502 req_pkt->bRequestType, req_pkt->bRequest); 505 req_pkt->bRequestType, req_pkt->bRequest);
@@ -616,8 +619,7 @@ static void sierra_close(struct tty_struct *tty,
616 } 619 }
617 620
618 usb_kill_urb(port->interrupt_in_urb); 621 usb_kill_urb(port->interrupt_in_urb);
619 622 tty_port_tty_set(&port->port, NULL);
620 port->port.tty = NULL; /* FIXME */
621} 623}
622 624
623static int sierra_startup(struct usb_serial *serial) 625static int sierra_startup(struct usb_serial *serial)
diff --git a/drivers/usb/serial/spcp8x5.c b/drivers/usb/serial/spcp8x5.c
index 283cf6b36b2c..1533d6e12238 100644
--- a/drivers/usb/serial/spcp8x5.c
+++ b/drivers/usb/serial/spcp8x5.c
@@ -755,7 +755,7 @@ static void spcp8x5_read_bulk_callback(struct urb *urb)
755 tty_flag = TTY_FRAME; 755 tty_flag = TTY_FRAME;
756 dev_dbg(&port->dev, "tty_flag = %d\n", tty_flag); 756 dev_dbg(&port->dev, "tty_flag = %d\n", tty_flag);
757 757
758 tty = port->port.tty; 758 tty = tty_port_tty_get(&port->port);
759 if (tty && urb->actual_length) { 759 if (tty && urb->actual_length) {
760 tty_buffer_request_room(tty, urb->actual_length + 1); 760 tty_buffer_request_room(tty, urb->actual_length + 1);
761 /* overrun is special, not associated with a char */ 761 /* overrun is special, not associated with a char */
@@ -765,6 +765,7 @@ static void spcp8x5_read_bulk_callback(struct urb *urb)
765 tty_insert_flip_char(tty, data[i], tty_flag); 765 tty_insert_flip_char(tty, data[i], tty_flag);
766 tty_flip_buffer_push(tty); 766 tty_flip_buffer_push(tty);
767 } 767 }
768 tty_kref_put(tty);
768 769
769 /* Schedule the next read _if_ we are still open */ 770 /* Schedule the next read _if_ we are still open */
770 if (port->port.count) { 771 if (port->port.count) {
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index 9a3e495c769c..c90237d48b0e 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -179,7 +179,7 @@ static int ti_set_mcr(struct ti_port *tport, unsigned int mcr);
179static int ti_get_lsr(struct ti_port *tport); 179static int ti_get_lsr(struct ti_port *tport);
180static int ti_get_serial_info(struct ti_port *tport, 180static int ti_get_serial_info(struct ti_port *tport,
181 struct serial_struct __user *ret_arg); 181 struct serial_struct __user *ret_arg);
182static int ti_set_serial_info(struct ti_port *tport, 182static int ti_set_serial_info(struct tty_struct *tty, struct ti_port *tport,
183 struct serial_struct __user *new_arg); 183 struct serial_struct __user *new_arg);
184static void ti_handle_new_msr(struct ti_port *tport, __u8 msr); 184static void ti_handle_new_msr(struct ti_port *tport, __u8 msr);
185 185
@@ -857,8 +857,8 @@ static int ti_ioctl(struct tty_struct *tty, struct file *file,
857 (struct serial_struct __user *)arg); 857 (struct serial_struct __user *)arg);
858 case TIOCSSERIAL: 858 case TIOCSSERIAL:
859 dbg("%s - (%d) TIOCSSERIAL", __func__, port->number); 859 dbg("%s - (%d) TIOCSSERIAL", __func__, port->number);
860 return ti_set_serial_info(tport, 860 return ti_set_serial_info(tty, tport,
861 (struct serial_struct __user *)arg); 861 (struct serial_struct __user *)arg);
862 case TIOCMIWAIT: 862 case TIOCMIWAIT:
863 dbg("%s - (%d) TIOCMIWAIT", __func__, port->number); 863 dbg("%s - (%d) TIOCMIWAIT", __func__, port->number);
864 cprev = tport->tp_icount; 864 cprev = tport->tp_icount;
@@ -1211,6 +1211,7 @@ static void ti_bulk_in_callback(struct urb *urb)
1211 struct device *dev = &urb->dev->dev; 1211 struct device *dev = &urb->dev->dev;
1212 int status = urb->status; 1212 int status = urb->status;
1213 int retval = 0; 1213 int retval = 0;
1214 struct tty_struct *tty;
1214 1215
1215 dbg("%s", __func__); 1216 dbg("%s", __func__);
1216 1217
@@ -1239,20 +1240,22 @@ static void ti_bulk_in_callback(struct urb *urb)
1239 return; 1240 return;
1240 } 1241 }
1241 1242
1242 if (port->port.tty && urb->actual_length) { 1243 tty = tty_port_tty_get(&port->port);
1244 if (tty && urb->actual_length) {
1243 usb_serial_debug_data(debug, dev, __func__, 1245 usb_serial_debug_data(debug, dev, __func__,
1244 urb->actual_length, urb->transfer_buffer); 1246 urb->actual_length, urb->transfer_buffer);
1245 1247
1246 if (!tport->tp_is_open) 1248 if (!tport->tp_is_open)
1247 dbg("%s - port closed, dropping data", __func__); 1249 dbg("%s - port closed, dropping data", __func__);
1248 else 1250 else
1249 ti_recv(&urb->dev->dev, port->port.tty, 1251 ti_recv(&urb->dev->dev, tty,
1250 urb->transfer_buffer, 1252 urb->transfer_buffer,
1251 urb->actual_length); 1253 urb->actual_length);
1252 1254
1253 spin_lock(&tport->tp_lock); 1255 spin_lock(&tport->tp_lock);
1254 tport->tp_icount.rx += urb->actual_length; 1256 tport->tp_icount.rx += urb->actual_length;
1255 spin_unlock(&tport->tp_lock); 1257 spin_unlock(&tport->tp_lock);
1258 tty_kref_put(tty);
1256 } 1259 }
1257 1260
1258exit: 1261exit:
@@ -1330,7 +1333,7 @@ static void ti_send(struct ti_port *tport)
1330{ 1333{
1331 int count, result; 1334 int count, result;
1332 struct usb_serial_port *port = tport->tp_port; 1335 struct usb_serial_port *port = tport->tp_port;
1333 struct tty_struct *tty = port->port.tty; /* FIXME */ 1336 struct tty_struct *tty = tty_port_tty_get(&port->port); /* FIXME */
1334 unsigned long flags; 1337 unsigned long flags;
1335 1338
1336 1339
@@ -1338,19 +1341,15 @@ static void ti_send(struct ti_port *tport)
1338 1341
1339 spin_lock_irqsave(&tport->tp_lock, flags); 1342 spin_lock_irqsave(&tport->tp_lock, flags);
1340 1343
1341 if (tport->tp_write_urb_in_use) { 1344 if (tport->tp_write_urb_in_use)
1342 spin_unlock_irqrestore(&tport->tp_lock, flags); 1345 goto unlock;
1343 return;
1344 }
1345 1346
1346 count = ti_buf_get(tport->tp_write_buf, 1347 count = ti_buf_get(tport->tp_write_buf,
1347 port->write_urb->transfer_buffer, 1348 port->write_urb->transfer_buffer,
1348 port->bulk_out_size); 1349 port->bulk_out_size);
1349 1350
1350 if (count == 0) { 1351 if (count == 0)
1351 spin_unlock_irqrestore(&tport->tp_lock, flags); 1352 goto unlock;
1352 return;
1353 }
1354 1353
1355 tport->tp_write_urb_in_use = 1; 1354 tport->tp_write_urb_in_use = 1;
1356 1355
@@ -1380,7 +1379,13 @@ static void ti_send(struct ti_port *tport)
1380 /* more room in the buffer for new writes, wakeup */ 1379 /* more room in the buffer for new writes, wakeup */
1381 if (tty) 1380 if (tty)
1382 tty_wakeup(tty); 1381 tty_wakeup(tty);
1382 tty_kref_put(tty);
1383 wake_up_interruptible(&tport->tp_write_wait); 1383 wake_up_interruptible(&tport->tp_write_wait);
1384 return;
1385unlock:
1386 spin_unlock_irqrestore(&tport->tp_lock, flags);
1387 tty_kref_put(tty);
1388 return;
1384} 1389}
1385 1390
1386 1391
@@ -1464,20 +1469,16 @@ static int ti_get_serial_info(struct ti_port *tport,
1464} 1469}
1465 1470
1466 1471
1467static int ti_set_serial_info(struct ti_port *tport, 1472static int ti_set_serial_info(struct tty_struct *tty, struct ti_port *tport,
1468 struct serial_struct __user *new_arg) 1473 struct serial_struct __user *new_arg)
1469{ 1474{
1470 struct usb_serial_port *port = tport->tp_port;
1471 struct serial_struct new_serial; 1475 struct serial_struct new_serial;
1472 1476
1473 if (copy_from_user(&new_serial, new_arg, sizeof(new_serial))) 1477 if (copy_from_user(&new_serial, new_arg, sizeof(new_serial)))
1474 return -EFAULT; 1478 return -EFAULT;
1475 1479
1476 tport->tp_flags = new_serial.flags & TI_SET_SERIAL_FLAGS; 1480 tport->tp_flags = new_serial.flags & TI_SET_SERIAL_FLAGS;
1477 /* FIXME */ 1481 tty->low_latency = (tport->tp_flags & ASYNC_LOW_LATENCY) ? 1 : 0;
1478 if (port->port.tty)
1479 port->port.tty->low_latency =
1480 (tport->tp_flags & ASYNC_LOW_LATENCY) ? 1 : 0;
1481 tport->tp_closing_wait = new_serial.closing_wait; 1482 tport->tp_closing_wait = new_serial.closing_wait;
1482 1483
1483 return 0; 1484 return 0;
@@ -1510,7 +1511,7 @@ static void ti_handle_new_msr(struct ti_port *tport, __u8 msr)
1510 tport->tp_msr = msr & TI_MSR_MASK; 1511 tport->tp_msr = msr & TI_MSR_MASK;
1511 1512
1512 /* handle CTS flow control */ 1513 /* handle CTS flow control */
1513 tty = tport->tp_port->port.tty; 1514 tty = tty_port_tty_get(&tport->tp_port->port);
1514 if (tty && C_CRTSCTS(tty)) { 1515 if (tty && C_CRTSCTS(tty)) {
1515 if (msr & TI_MSR_CTS) { 1516 if (msr & TI_MSR_CTS) {
1516 tty->hw_stopped = 0; 1517 tty->hw_stopped = 0;
@@ -1519,6 +1520,7 @@ static void ti_handle_new_msr(struct ti_port *tport, __u8 msr)
1519 tty->hw_stopped = 1; 1520 tty->hw_stopped = 1;
1520 } 1521 }
1521 } 1522 }
1523 tty_kref_put(tty);
1522} 1524}
1523 1525
1524 1526
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 4f7f9e3ae0a4..e7d4246027b2 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -214,7 +214,7 @@ static int serial_open (struct tty_struct *tty, struct file *filp)
214 /* set up our port structure making the tty driver 214 /* set up our port structure making the tty driver
215 * remember our port object, and us it */ 215 * remember our port object, and us it */
216 tty->driver_data = port; 216 tty->driver_data = port;
217 port->port.tty = tty; 217 tty_port_tty_set(&port->port, tty);
218 218
219 if (port->port.count == 1) { 219 if (port->port.count == 1) {
220 220
@@ -246,7 +246,7 @@ bailout_module_put:
246bailout_mutex_unlock: 246bailout_mutex_unlock:
247 port->port.count = 0; 247 port->port.count = 0;
248 tty->driver_data = NULL; 248 tty->driver_data = NULL;
249 port->port.tty = NULL; 249 tty_port_tty_set(&port->port, NULL);
250 mutex_unlock(&port->mutex); 250 mutex_unlock(&port->mutex);
251bailout_kref_put: 251bailout_kref_put:
252 usb_serial_put(serial); 252 usb_serial_put(serial);
@@ -276,10 +276,11 @@ static void serial_close(struct tty_struct *tty, struct file *filp)
276 port->serial->type->close(tty, port, filp); 276 port->serial->type->close(tty, port, filp);
277 277
278 if (port->port.count == (port->console? 1 : 0)) { 278 if (port->port.count == (port->console? 1 : 0)) {
279 if (port->port.tty) { 279 struct tty_struct *tty = tty_port_tty_get(&port->port);
280 if (port->port.tty->driver_data) 280 if (tty) {
281 port->port.tty->driver_data = NULL; 281 if (tty->driver_data)
282 port->port.tty = NULL; 282 tty->driver_data = NULL;
283 tty_port_tty_set(&port->port, NULL);
283 } 284 }
284 } 285 }
285 286
@@ -508,11 +509,12 @@ static void usb_serial_port_work(struct work_struct *work)
508 if (!port) 509 if (!port)
509 return; 510 return;
510 511
511 tty = port->port.tty; 512 tty = tty_port_tty_get(&port->port);
512 if (!tty) 513 if (!tty)
513 return; 514 return;
514 515
515 tty_wakeup(tty); 516 tty_wakeup(tty);
517 tty_kref_put(tty);
516} 518}
517 519
518static void port_release(struct device *dev) 520static void port_release(struct device *dev)
@@ -819,6 +821,7 @@ int usb_serial_probe(struct usb_interface *interface,
819 port = kzalloc(sizeof(struct usb_serial_port), GFP_KERNEL); 821 port = kzalloc(sizeof(struct usb_serial_port), GFP_KERNEL);
820 if (!port) 822 if (!port)
821 goto probe_error; 823 goto probe_error;
824 tty_port_init(&port->port);
822 port->serial = serial; 825 port->serial = serial;
823 spin_lock_init(&port->lock); 826 spin_lock_init(&port->lock);
824 mutex_init(&port->mutex); 827 mutex_init(&port->mutex);
@@ -1040,8 +1043,11 @@ void usb_serial_disconnect(struct usb_interface *interface)
1040 for (i = 0; i < serial->num_ports; ++i) { 1043 for (i = 0; i < serial->num_ports; ++i) {
1041 port = serial->port[i]; 1044 port = serial->port[i];
1042 if (port) { 1045 if (port) {
1043 if (port->port.tty) 1046 struct tty_struct *tty = tty_port_tty_get(&port->port);
1044 tty_hangup(port->port.tty); 1047 if (tty) {
1048 tty_hangup(tty);
1049 tty_kref_put(tty);
1050 }
1045 kill_traffic(port); 1051 kill_traffic(port);
1046 } 1052 }
1047 } 1053 }
diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
index cf8924f9a2cc..a6d1c75a1c89 100644
--- a/drivers/usb/serial/visor.c
+++ b/drivers/usb/serial/visor.c
@@ -499,7 +499,7 @@ static void visor_read_bulk_callback(struct urb *urb)
499 int status = urb->status; 499 int status = urb->status;
500 struct tty_struct *tty; 500 struct tty_struct *tty;
501 int result; 501 int result;
502 int available_room; 502 int available_room = 0;
503 503
504 dbg("%s - port %d", __func__, port->number); 504 dbg("%s - port %d", __func__, port->number);
505 505
@@ -512,13 +512,17 @@ static void visor_read_bulk_callback(struct urb *urb)
512 usb_serial_debug_data(debug, &port->dev, __func__, 512 usb_serial_debug_data(debug, &port->dev, __func__,
513 urb->actual_length, data); 513 urb->actual_length, data);
514 514
515 tty = port->port.tty; 515 if (urb->actual_length) {
516 if (tty && urb->actual_length) { 516 tty = tty_port_tty_get(&port->port);
517 available_room = tty_buffer_request_room(tty, 517 if (tty) {
518 available_room = tty_buffer_request_room(tty,
518 urb->actual_length); 519 urb->actual_length);
519 if (available_room) { 520 if (available_room) {
520 tty_insert_flip_string(tty, data, available_room); 521 tty_insert_flip_string(tty, data,
521 tty_flip_buffer_push(tty); 522 available_room);
523 tty_flip_buffer_push(tty);
524 }
525 tty_kref_put(tty);
522 } 526 }
523 spin_lock(&priv->lock); 527 spin_lock(&priv->lock);
524 priv->bytes_in += available_room; 528 priv->bytes_in += available_room;
diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
index 3a9d14384a43..11c8b97a5177 100644
--- a/drivers/usb/serial/whiteheat.c
+++ b/drivers/usb/serial/whiteheat.c
@@ -1481,7 +1481,7 @@ static void rx_data_softint(struct work_struct *work)
1481 struct whiteheat_private *info = 1481 struct whiteheat_private *info =
1482 container_of(work, struct whiteheat_private, rx_work); 1482 container_of(work, struct whiteheat_private, rx_work);
1483 struct usb_serial_port *port = info->port; 1483 struct usb_serial_port *port = info->port;
1484 struct tty_struct *tty = port->port.tty; 1484 struct tty_struct *tty = tty_port_tty_get(&port->port);
1485 struct whiteheat_urb_wrap *wrap; 1485 struct whiteheat_urb_wrap *wrap;
1486 struct urb *urb; 1486 struct urb *urb;
1487 unsigned long flags; 1487 unsigned long flags;
@@ -1493,7 +1493,7 @@ static void rx_data_softint(struct work_struct *work)
1493 spin_lock_irqsave(&info->lock, flags); 1493 spin_lock_irqsave(&info->lock, flags);
1494 if (info->flags & THROTTLED) { 1494 if (info->flags & THROTTLED) {
1495 spin_unlock_irqrestore(&info->lock, flags); 1495 spin_unlock_irqrestore(&info->lock, flags);
1496 return; 1496 goto out;
1497 } 1497 }
1498 1498
1499 list_for_each_safe(tmp, tmp2, &info->rx_urb_q) { 1499 list_for_each_safe(tmp, tmp2, &info->rx_urb_q) {
@@ -1513,7 +1513,7 @@ static void rx_data_softint(struct work_struct *work)
1513 spin_unlock_irqrestore(&info->lock, flags); 1513 spin_unlock_irqrestore(&info->lock, flags);
1514 tty_flip_buffer_push(tty); 1514 tty_flip_buffer_push(tty);
1515 schedule_work(&info->rx_work); 1515 schedule_work(&info->rx_work);
1516 return; 1516 goto out;
1517 } 1517 }
1518 tty_insert_flip_string(tty, urb->transfer_buffer, len); 1518 tty_insert_flip_string(tty, urb->transfer_buffer, len);
1519 sent += len; 1519 sent += len;
@@ -1536,6 +1536,8 @@ static void rx_data_softint(struct work_struct *work)
1536 1536
1537 if (sent) 1537 if (sent)
1538 tty_flip_buffer_push(tty); 1538 tty_flip_buffer_push(tty);
1539out:
1540 tty_kref_put(tty);
1539} 1541}
1540 1542
1541 1543
generated by cgit v1.2.2 (git 2.25.0) at 2024-12-17 10:26:11 -0500