3 files changed, 7 insertions, 5 deletions

diff --git a/drivers/scsi/qla4xxx/ql4_def.h b/drivers/scsi/qla4xxx/ql4_def.h
index fcb1dff9bc19..ace637bf254e 100644
--- a/drivers/scsi/qla4xxx/ql4_def.h
+++ b/drivers/scsi/qla4xxx/ql4_def.h
@@ -631,6 +631,7 @@ struct ql4_task_data {
         dma_addr_t data_dma;
         void *req_buffer;
         dma_addr_t req_dma;
+        uint32_t req_len;
         void *resp_buffer;
         dma_addr_t resp_dma;
         uint32_t resp_len;
diff --git a/drivers/scsi/qla4xxx/ql4_iocb.c b/drivers/scsi/qla4xxx/ql4_iocb.c
index ad40a613bcf1..410669351906 100644
--- a/drivers/scsi/qla4xxx/ql4_iocb.c
+++ b/drivers/scsi/qla4xxx/ql4_iocb.c
@@ -407,7 +407,7 @@ int qla4xxx_send_passthru0(struct iscsi_task *task)
         passthru_iocb->timeout = cpu_to_le16(PT_DEFAULT_TIMEOUT);
 
         /* Setup the out & in DSDs */
-        if (task->data_count) {
+        if (task_data->req_len) {
                 memcpy((uint8_t *)task_data->req_buffer +
                        sizeof(struct iscsi_hdr), task->data, task->data_count);
                 ctrl_flags |= PT_FLAG_SEND_BUFFER;
diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
index 8ed3e2fc1584..fca3d2b96651 100644
--- a/drivers/scsi/qla4xxx/ql4_os.c
+++ b/drivers/scsi/qla4xxx/ql4_os.c
@@ -1272,7 +1272,7 @@ static int qla4xxx_alloc_pdu(struct iscsi_task *task, uint8_t opcode)
         DEBUG2(ql4_printk(KERN_INFO, ha, "%s: MaxRecvLen %u, iscsi hrd %d\n",
                       __func__, task->conn->max_recv_dlength, hdr_len));
 
-        task_data->resp_len = task->conn->max_recv_dlength;
+        task_data->resp_len = task->conn->max_recv_dlength + hdr_len;
         task_data->resp_buffer = dma_alloc_coherent(&ha->pdev->dev,
                                                     task_data->resp_len,
                                                     &task_data->resp_dma,
@@ -1280,8 +1280,9 @@ static int qla4xxx_alloc_pdu(struct iscsi_task *task, uint8_t opcode)
         if (!task_data->resp_buffer)
                 goto exit_alloc_pdu;
 
+        task_data->req_len = task->data_count + hdr_len;
         task_data->req_buffer = dma_alloc_coherent(&ha->pdev->dev,
-                                                   task->data_count + hdr_len,
+                                                   task_data->req_len,
                                                    &task_data->req_dma,
                                                    GFP_ATOMIC);
         if (!task_data->req_buffer)
@@ -1299,7 +1300,7 @@ exit_alloc_pdu:
                                   task_data->resp_buffer, task_data->resp_dma);
 
         if (task_data->req_buffer)
-                dma_free_coherent(&ha->pdev->dev, task->data_count + hdr_len,
+                dma_free_coherent(&ha->pdev->dev, task_data->req_len,
                                   task_data->req_buffer, task_data->req_dma);
         return -ENOMEM;
 }
@@ -1328,7 +1329,7 @@ static void qla4xxx_task_cleanup(struct iscsi_task *task)
 
         dma_free_coherent(&ha->pdev->dev, task_data->resp_len,
                           task_data->resp_buffer, task_data->resp_dma);
-        dma_free_coherent(&ha->pdev->dev, task->data_count + hdr_len,
+        dma_free_coherent(&ha->pdev->dev, task_data->req_len,
                           task_data->req_buffer, task_data->req_dma);
         return;
 }