1 files changed, 5 insertions, 2 deletions

diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
index c0b8b33e935c..d0b139cccbbc 100644
--- a/drivers/scsi/iscsi_tcp.c
+++ b/drivers/scsi/iscsi_tcp.c
@@ -415,8 +415,8 @@ iscsi_r2t_rsp(struct iscsi_conn *conn, struct iscsi_cmd_task *ctask)
         iscsi_solicit_data_init(conn, ctask, r2t);
 
         tcp_ctask->exp_r2tsn = r2tsn + 1;
-        tcp_ctask->xmstate |= XMSTATE_SOL_HDR;
         __kfifo_put(tcp_ctask->r2tqueue, (void*)&r2t, sizeof(void*));
+        tcp_ctask->xmstate |= XMSTATE_SOL_HDR;
         list_move_tail(&ctask->running, &conn->xmitqueue);
 
         scsi_queue_work(session->host, &conn->xmitwork);
@@ -1627,9 +1627,12 @@ static int iscsi_send_sol_pdu(struct iscsi_conn *conn,
         if (tcp_ctask->xmstate & XMSTATE_SOL_HDR) {
                 tcp_ctask->xmstate &= ~XMSTATE_SOL_HDR;
                 tcp_ctask->xmstate |= XMSTATE_SOL_DATA;
-                if (!tcp_ctask->r2t)
+                if (!tcp_ctask->r2t) {
+                        spin_lock_bh(&session->lock);
                         __kfifo_get(tcp_ctask->r2tqueue, (void*)&tcp_ctask->r2t,
                                     sizeof(void*));
+                        spin_unlock_bh(&session->lock);
+                }
 send_hdr:
                 r2t = tcp_ctask->r2t;
                 dtask = &r2t->dtask;