2 files changed, 8 insertions, 4 deletions

diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 4afef5cdcb17..ce9d73a292e2 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -542,10 +542,17 @@ static void scsi_requeue_command(struct request_queue *q, struct scsi_cmnd *cmd)
 
 void scsi_next_command(struct scsi_cmnd *cmd)
 {
-        struct request_queue *q = cmd->device->request_queue;
+        struct scsi_device *sdev = cmd->device;
+        struct request_queue *q = sdev->request_queue;
+
+        /* need to hold a reference on the device before we let go of the cmd */
+        get_device(&sdev->sdev_gendev);
 
         scsi_put_command(cmd);
         scsi_run_queue(q);
+
+        /* ok to remove device now */
+        put_device(&sdev->sdev_gendev);
 }
 
 void scsi_run_host_queues(struct Scsi_Host *shost)
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 374853df9cca..94e5167f260d 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -266,8 +266,6 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget,
                         /*
                          * if LLDD reports slave not present, don't clutter
                          * console with alloc failure messages
-
-
                          */
                         if (ret == -ENXIO)
                                 display_failure_msg = 0;
@@ -279,7 +277,6 @@ static struct scsi_device *scsi_alloc_sdev(struct scsi_target *starget,
 
 out_device_destroy:
         transport_destroy_device(&sdev->sdev_gendev);
-        scsi_free_queue(sdev->request_queue);
         put_device(&sdev->sdev_gendev);
 out:
         if (display_failure_msg)