1 files changed, 7 insertions, 5 deletions

diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index c4918b86ed19..0d0fa91c0251 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -1297,6 +1297,7 @@ static int hso_serial_open(struct tty_struct *tty, struct file *filp)
         /* setup */
         spin_lock_irq(&serial->serial_lock);
         tty->driver_data = serial;
+        tty_kref_put(serial->tty);
         serial->tty = tty_kref_get(tty);
         spin_unlock_irq(&serial->serial_lock);
 
@@ -1792,8 +1793,8 @@ static int mux_device_request(struct hso_serial *serial, u8 type, u16 port,
 
         /* initialize */
         ctrl_req->wValue = 0;
-        ctrl_req->wIndex = hso_port_to_mux(port);
-        ctrl_req->wLength = size;
+        ctrl_req->wIndex = cpu_to_le16(hso_port_to_mux(port));
+        ctrl_req->wLength = cpu_to_le16(size);
 
         if (type == USB_CDC_GET_ENCAPSULATED_RESPONSE) {
                 /* Reading command */
@@ -2043,9 +2044,8 @@ static int put_rxbuf_data(struct urb *urb, struct hso_serial *serial)
                 return -2;
         }
 
-        spin_lock(&serial->serial_lock);
+        /* All callers to put_rxbuf_data hold serial_lock */
         tty = tty_kref_get(serial->tty);
-        spin_unlock(&serial->serial_lock);
 
         /* Push data to tty */
         if (tty) {
@@ -2053,8 +2053,10 @@ static int put_rxbuf_data(struct urb *urb, struct hso_serial *serial)
                         serial->curr_rx_urb_offset;
                 D1("data to push to tty");
                 while (write_length_remaining) {
-                        if (test_bit(TTY_THROTTLED, &tty->flags))
+                        if (test_bit(TTY_THROTTLED, &tty->flags)) {
+                                tty_kref_put(tty);
                                 return -1;
+                        }
                         curr_write_len =  tty_insert_flip_string
                                 (tty, urb->transfer_buffer +
                                  serial->curr_rx_urb_offset,