You mean call to tty_put_user(), correct? Thanks for this catch.
So what about to unlock the lock for this time? Because we need to hold 
the lock while checking tty->read_cnt in the while loop condition, correct?

I think you are right on that yes.

Alan