2 files changed, 18 insertions, 10 deletions

diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index d16b02423d61..7d2e91cccb13 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -2081,10 +2081,6 @@ static int cdrom_read_cdda_bpc(struct cdrom_device_info *cdi, __u8 __user *ubuf,
         if (!q)
                 return -ENXIO;
 
-        rq = blk_get_request(q, READ, GFP_KERNEL);
-        if (!rq)
-                return -ENOMEM;
-
         cdi->last_sense = 0;
 
         while (nframes) {
@@ -2096,9 +2092,17 @@ static int cdrom_read_cdda_bpc(struct cdrom_device_info *cdi, __u8 __user *ubuf,
 
                 len = nr * CD_FRAMESIZE_RAW;
 
+                rq = blk_get_request(q, READ, GFP_KERNEL);
+                if (!rq) {
+                        ret = -ENOMEM;
+                        break;
+                }
+
                 ret = blk_rq_map_user(q, rq, NULL, ubuf, len, GFP_KERNEL);
-                if (ret)
+                if (ret) {
+                        blk_put_request(rq);
                         break;
+                }
 
                 rq->cmd[0] = GPCMD_READ_CD;
                 rq->cmd[1] = 1 << 2;
@@ -2124,6 +2128,7 @@ static int cdrom_read_cdda_bpc(struct cdrom_device_info *cdi, __u8 __user *ubuf,
 
                 if (blk_rq_unmap_user(bio))
                         ret = -EFAULT;
+                blk_put_request(rq);
 
                 if (ret)
                         break;
@@ -2133,7 +2138,6 @@ static int cdrom_read_cdda_bpc(struct cdrom_device_info *cdi, __u8 __user *ubuf,
                 ubuf += len;
         }
 
-        blk_put_request(rq);
         return ret;
 }
 
diff --git a/drivers/scsi/device_handler/scsi_dh_hp_sw.c b/drivers/scsi/device_handler/scsi_dh_hp_sw.c
index 9aec4ca64e56..f7da7530875e 100644
--- a/drivers/scsi/device_handler/scsi_dh_hp_sw.c
+++ b/drivers/scsi/device_handler/scsi_dh_hp_sw.c
@@ -107,6 +107,7 @@ static int hp_sw_tur(struct scsi_device *sdev, struct hp_sw_dh_data *h)
         struct request *req;
         int ret;
 
+retry:
         req = blk_get_request(sdev->request_queue, WRITE, GFP_NOIO);
         if (!req)
                 return SCSI_DH_RES_TEMP_UNAVAIL;
@@ -121,7 +122,6 @@ static int hp_sw_tur(struct scsi_device *sdev, struct hp_sw_dh_data *h)
         memset(req->sense, 0, SCSI_SENSE_BUFFERSIZE);
         req->sense_len = 0;
 
-retry:
         ret = blk_execute_rq(req->q, NULL, req, 1);
         if (ret == -EIO) {
                 if (req->sense_len > 0) {
@@ -136,8 +136,10 @@ retry:
                 h->path_state = HP_SW_PATH_ACTIVE;
                 ret = SCSI_DH_OK;
         }
-        if (ret == SCSI_DH_IMM_RETRY)
+        if (ret == SCSI_DH_IMM_RETRY) {
+                blk_put_request(req);
                 goto retry;
+        }
         if (ret == SCSI_DH_DEV_OFFLINED) {
                 h->path_state = HP_SW_PATH_PASSIVE;
                 ret = SCSI_DH_OK;
@@ -200,6 +202,7 @@ static int hp_sw_start_stop(struct scsi_device *sdev, struct hp_sw_dh_data *h)
         struct request *req;
         int ret, retry;
 
+retry:
         req = blk_get_request(sdev->request_queue, WRITE, GFP_NOIO);
         if (!req)
                 return SCSI_DH_RES_TEMP_UNAVAIL;
@@ -216,7 +219,6 @@ static int hp_sw_start_stop(struct scsi_device *sdev, struct hp_sw_dh_data *h)
         req->sense_len = 0;
         retry = h->retries;
 
-retry:
         ret = blk_execute_rq(req->q, NULL, req, 1);
         if (ret == -EIO) {
                 if (req->sense_len > 0) {
@@ -231,8 +233,10 @@ retry:
                 ret = SCSI_DH_OK;
 
         if (ret == SCSI_DH_RETRY) {
-                if (--retry)
+                if (--retry) {
+                        blk_put_request(req);
                         goto retry;
+                }
                 ret = SCSI_DH_IO;
         }