1 files changed, 14 insertions, 2 deletions

diff --git a/drivers/char/n_r3964.c b/drivers/char/n_r3964.c
index 6b918b80f73e..3f6486e9f1ec 100644
--- a/drivers/char/n_r3964.c
+++ b/drivers/char/n_r3964.c
@@ -1075,12 +1075,15 @@ static ssize_t r3964_read(struct tty_struct *tty, struct file *file,
 
         TRACE_L("read()");
 
+        lock_kernel();
+
         pClient = findClient(pInfo, task_pid(current));
         if (pClient) {
                 pMsg = remove_msg(pInfo, pClient);
                 if (pMsg == NULL) {
                         /* no messages available. */
                         if (file->f_flags & O_NONBLOCK) {
+                                unlock_kernel();
                                 return -EAGAIN;
                         }
                         /* block until there is a message: */
@@ -1090,8 +1093,10 @@ static ssize_t r3964_read(struct tty_struct *tty, struct file *file,
 
                 /* If we still haven't got a message, we must have been signalled */
 
-                if (!pMsg)
+                if (!pMsg) {
+                        unlock_kernel();
                         return -EINTR;
+                }
 
                 /* deliver msg to client process: */
                 theMsg.msg_id = pMsg->msg_id;
@@ -1102,12 +1107,15 @@ static ssize_t r3964_read(struct tty_struct *tty, struct file *file,
                 kfree(pMsg);
                 TRACE_M("r3964_read - msg kfree %p", pMsg);
 
-                if (copy_to_user(buf, &theMsg, count))
+                if (copy_to_user(buf, &theMsg, count)) {
+                        unlock_kernel();
                         return -EFAULT;
+                }
 
                 TRACE_PS("read - return %d", count);
                 return count;
         }
+        unlock_kernel();
         return -EPERM;
 }
 
@@ -1156,6 +1164,8 @@ static ssize_t r3964_write(struct tty_struct *tty, struct file *file,
         pHeader->locks = 0;
         pHeader->owner = NULL;
 
+        lock_kernel();
+
         pClient = findClient(pInfo, task_pid(current));
         if (pClient) {
                 pHeader->owner = pClient;
@@ -1173,6 +1183,8 @@ static ssize_t r3964_write(struct tty_struct *tty, struct file *file,
         add_tx_queue(pInfo, pHeader);
         trigger_transmit(pInfo);
 
+        unlock_kernel();
+
         return 0;
 }