2 files changed, 7 insertions, 2 deletions

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index f492a7f2b6ee..e057e5381465 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -297,6 +297,8 @@ static void acm_ctrl_irq(struct urb *urb)
         if (!ACM_READY(acm))
                 goto exit;
 
+        usb_mark_last_busy(acm->dev);
+
         data = (unsigned char *)(dr + 1);
         switch (dr->bNotificationType) {
         case USB_CDC_NOTIFY_NETWORK_CONNECTION:
@@ -336,7 +338,6 @@ static void acm_ctrl_irq(struct urb *urb)
                 break;
         }
 exit:
-        usb_mark_last_busy(acm->dev);
         retval = usb_submit_urb(urb, GFP_ATOMIC);
         if (retval)
                 dev_err(&urb->dev->dev, "%s - usb_submit_urb failed with "
@@ -533,6 +534,8 @@ static void acm_softint(struct work_struct *work)
         if (!ACM_READY(acm))
                 return;
         tty = tty_port_tty_get(&acm->port);
+        if (!tty)
+                return;
         tty_wakeup(tty);
         tty_kref_put(tty);
 }
@@ -646,8 +649,10 @@ static void acm_port_down(struct acm *acm)
                 usb_kill_urb(acm->ctrlurb);
                 for (i = 0; i < ACM_NW; i++)
                         usb_kill_urb(acm->wb[i].urb);
+                tasklet_disable(&acm->urb_task);
                 for (i = 0; i < nr; i++)
                         usb_kill_urb(acm->ru[i].urb);
+                tasklet_enable(&acm->urb_task);
                 acm->control->needs_remote_wakeup = 0;
                 usb_autopm_put_interface(acm->control);
         }
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 47085e5879ab..a97c018dd419 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -281,7 +281,7 @@ static void cleanup(struct wdm_device *desc)
                           desc->sbuf,
                           desc->validity->transfer_dma);
         usb_free_coherent(interface_to_usbdev(desc->intf),
-                          desc->wMaxCommand,
+                          desc->bMaxPacketSize0,
                           desc->inbuf,
                           desc->response->transfer_dma);
         kfree(desc->orq);