2 files changed, 11 insertions, 6 deletions

diff --git a/drivers/usb/gadget/lh7a40x_udc.c b/drivers/usb/gadget/lh7a40x_udc.c
index e02fea5a5433..1a362c5e7f3d 100644
--- a/drivers/usb/gadget/lh7a40x_udc.c
+++ b/drivers/usb/gadget/lh7a40x_udc.c
@@ -1062,11 +1062,11 @@ static int lh7a40x_ep_enable(struct usb_ep *_ep,
         ep->pio_irqs = 0;
         ep->ep.maxpacket = le16_to_cpu(desc->wMaxPacketSize);
 
+        spin_unlock_irqrestore(&ep->dev->lock, flags);
+
         /* Reset halt state (does flush) */
         lh7a40x_set_halt(_ep, 0);
 
-        spin_unlock_irqrestore(&ep->dev->lock, flags);
-
         DEBUG("%s: enabled %s\n", __FUNCTION__, _ep->name);
         return 0;
 }
@@ -1775,6 +1775,7 @@ static void lh7a40x_ep0_setup(struct lh7a40x_udc *dev, u32 csr)
                                         break;
 
                                 qep = &dev->ep[ep_num];
+                                spin_unlock(&dev->lock);
                                 if (ctrl.bRequest == USB_REQ_SET_FEATURE) {
                                         DEBUG_SETUP("SET_FEATURE (%d)\n",
                                                     ep_num);
@@ -1784,6 +1785,7 @@ static void lh7a40x_ep0_setup(struct lh7a40x_udc *dev, u32 csr)
                                                     ep_num);
                                         lh7a40x_set_halt(&qep->ep, 0);
                                 }
+                                spin_lock(&dev->lock);
                                 usb_set_index(0);
 
                                 /* Reply with a ZLP on next IN token */
diff --git a/drivers/usb/gadget/rndis.c b/drivers/usb/gadget/rndis.c
index 9689efeb364c..6d6eaad73968 100644
--- a/drivers/usb/gadget/rndis.c
+++ b/drivers/usb/gadget/rndis.c
@@ -853,11 +853,14 @@ static int rndis_query_response (int configNr, rndis_query_msg_type *buf)
         // DEBUG("%s: OID = %08X\n", __FUNCTION__, cpu_to_le32(buf->OID));
         if (!rndis_per_dev_params [configNr].dev) return -ENOTSUPP;
         
-        /* 
-         * we need more memory: 
-         * oid_supported_list is the largest answer 
+        /*
+         * we need more memory:
+         * gen_ndis_query_resp expects enough space for
+         * rndis_query_cmplt_type followed by data.
+         * oid_supported_list is the largest data reply
          */
-        r = rndis_add_response (configNr, sizeof (oid_supported_list));
+        r = rndis_add_response (configNr,
+                sizeof (oid_supported_list) + sizeof(rndis_query_cmplt_type));
         if (!r)
                 return -ENOMEM;
         resp = (rndis_query_cmplt_type *) r->buf;