1 files changed, 9 insertions, 4 deletions

diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index 35b61f7d6c63..38e44b9abf0f 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -753,7 +753,8 @@ static void iscsit_unmap_iovec(struct iscsi_cmd *cmd)
 
 static void iscsit_ack_from_expstatsn(struct iscsi_conn *conn, u32 exp_statsn)
 {
-        struct iscsi_cmd *cmd;
+        LIST_HEAD(ack_list);
+        struct iscsi_cmd *cmd, *cmd_p;
 
         conn->exp_statsn = exp_statsn;
 
@@ -761,19 +762,23 @@ static void iscsit_ack_from_expstatsn(struct iscsi_conn *conn, u32 exp_statsn)
                 return;
 
         spin_lock_bh(&conn->cmd_lock);
-        list_for_each_entry(cmd, &conn->conn_cmd_list, i_conn_node) {
+        list_for_each_entry_safe(cmd, cmd_p, &conn->conn_cmd_list, i_conn_node) {
                 spin_lock(&cmd->istate_lock);
                 if ((cmd->i_state == ISTATE_SENT_STATUS) &&
                     iscsi_sna_lt(cmd->stat_sn, exp_statsn)) {
                         cmd->i_state = ISTATE_REMOVE;
                         spin_unlock(&cmd->istate_lock);
-                        iscsit_add_cmd_to_immediate_queue(cmd, conn,
-                                                cmd->i_state);
+                        list_move_tail(&cmd->i_conn_node, &ack_list);
                         continue;
                 }
                 spin_unlock(&cmd->istate_lock);
         }
         spin_unlock_bh(&conn->cmd_lock);
+
+        list_for_each_entry_safe(cmd, cmd_p, &ack_list, i_conn_node) {
+                list_del(&cmd->i_conn_node);
+                iscsit_free_cmd(cmd, false);
+        }
 }
 
 static int iscsit_allocate_iovecs(struct iscsi_cmd *cmd)