1 files changed, 29 insertions, 13 deletions

diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 4afef5cdcb17..dc249cb970ea 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -542,10 +542,17 @@ static void scsi_requeue_command(struct request_queue *q, struct scsi_cmnd *cmd)
 
 void scsi_next_command(struct scsi_cmnd *cmd)
 {
-        struct request_queue *q = cmd->device->request_queue;
+        struct scsi_device *sdev = cmd->device;
+        struct request_queue *q = sdev->request_queue;
+
+        /* need to hold a reference on the device before we let go of the cmd */
+        get_device(&sdev->sdev_gendev);
 
         scsi_put_command(cmd);
         scsi_run_queue(q);
+
+        /* ok to remove device now */
+        put_device(&sdev->sdev_gendev);
 }
 
 void scsi_run_host_queues(struct Scsi_Host *shost)
@@ -1078,6 +1085,26 @@ static void scsi_generic_done(struct scsi_cmnd *cmd)
         scsi_io_completion(cmd, cmd->result == 0 ? cmd->bufflen : 0, 0);
 }
 
+void scsi_setup_blk_pc_cmnd(struct scsi_cmnd *cmd, int retries)
+{
+        struct request *req = cmd->request;
+
+        BUG_ON(sizeof(req->cmd) > sizeof(cmd->cmnd));
+        memcpy(cmd->cmnd, req->cmd, sizeof(cmd->cmnd));
+        cmd->cmd_len = req->cmd_len;
+        if (!req->data_len)
+                cmd->sc_data_direction = DMA_NONE;
+        else if (rq_data_dir(req) == WRITE)
+                cmd->sc_data_direction = DMA_TO_DEVICE;
+        else
+                cmd->sc_data_direction = DMA_FROM_DEVICE;
+        
+        cmd->transfersize = req->data_len;
+        cmd->allowed = retries;
+        cmd->timeout_per_command = req->timeout;
+}
+EXPORT_SYMBOL_GPL(scsi_setup_blk_pc_cmnd);
+
 static int scsi_prep_fn(struct request_queue *q, struct request *req)
 {
         struct scsi_device *sdev = q->queuedata;
@@ -1213,18 +1240,7 @@ static int scsi_prep_fn(struct request_queue *q, struct request *req)
                                 goto kill;
                         }
                 } else {
-                        memcpy(cmd->cmnd, req->cmd, sizeof(cmd->cmnd));
-                        cmd->cmd_len = req->cmd_len;
-                        if (rq_data_dir(req) == WRITE)
-                                cmd->sc_data_direction = DMA_TO_DEVICE;
-                        else if (req->data_len)
-                                cmd->sc_data_direction = DMA_FROM_DEVICE;
-                        else
-                                cmd->sc_data_direction = DMA_NONE;
-                        
-                        cmd->transfersize = req->data_len;
-                        cmd->allowed = 3;
-                        cmd->timeout_per_command = req->timeout;
+                        scsi_setup_blk_pc_cmnd(cmd, 3);
                         cmd->done = scsi_generic_done;
                 }
         }