Attached is a patch that changes the 2.5.x disconnect to be similar to
2.4.x disconnect. This doesn't fix the race, but does shrink the
window such that I've never seen it trigger, even under testing
designed to do that.

There doesn't seem to be a good way to fix the race. The fix should be
to have _disconnect force any sleeping semaphore holders to run to
completion between the end of the loop in the patch below and the spot
where the underlying memory is freed, but I don't see a way to do
that.


diff -Naur linux-2.5.49-2-fix-taint/drivers/usb/serial/usb-serial.c linux-2.5.49-3-fix-drvdata/drivers/usb/serial/usb-
serial.c