2 files changed, 14 insertions, 12 deletions

diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index db740e7e9ba2..35b61f7d6c63 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -1073,7 +1073,6 @@ int iscsit_process_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
                 if (cmd->reject_reason)
                         return 0;
 
-                target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd);
                 return 1;
         }
         /*
@@ -1111,14 +1110,10 @@ after_immediate_data:
                  */
                 cmdsn_ret = iscsit_sequence_cmd(cmd->conn, cmd,
                                         (unsigned char *)hdr, hdr->cmdsn);
-                if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER) {
+                if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER)
                         return -1;
-                } else if (cmdsn_ret == CMDSN_LOWER_THAN_EXP) {
-                        target_put_sess_cmd(conn->sess->se_sess, &cmd->se_cmd);
-                        return 0;
-                }
 
-                if (cmd->sense_reason) {
+                if (cmd->sense_reason || cmdsn_ret == CMDSN_LOWER_THAN_EXP) {
                         int rc;
 
                         rc = iscsit_dump_data_payload(cmd->conn,
@@ -1514,6 +1509,10 @@ int iscsit_setup_nop_out(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
         if (hdr->itt == RESERVED_ITT && !(hdr->opcode & ISCSI_OP_IMMEDIATE)) {
                 pr_err("NOPOUT ITT is reserved, but Immediate Bit is"
                         " not set, protocol error.\n");
+                if (!cmd)
+                        return iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
+                                                 (unsigned char *)hdr);
+
                 return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR,
                                          (unsigned char *)hdr);
         }
@@ -1523,6 +1522,10 @@ int iscsit_setup_nop_out(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
                         " greater than MaxXmitDataSegmentLength: %u, protocol"
                         " error.\n", payload_length,
                         conn->conn_ops->MaxXmitDataSegmentLength);
+                if (!cmd)
+                        return iscsit_add_reject(conn, ISCSI_REASON_PROTOCOL_ERROR,
+                                                 (unsigned char *)hdr);
+
                 return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR,
                                          (unsigned char *)hdr);
         }
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index 7aa35e5d20d3..1794c753954a 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -1243,12 +1243,11 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
                 if (np->np_thread_state == ISCSI_NP_THREAD_RESET) {
                         spin_unlock_bh(&np->np_thread_lock);
                         complete(&np->np_restart_comp);
-                        if (ret == -ENODEV) {
-                                iscsit_put_transport(conn->conn_transport);
-                                kfree(conn);
-                                conn = NULL;
+                        iscsit_put_transport(conn->conn_transport);
+                        kfree(conn);
+                        conn = NULL;
+                        if (ret == -ENODEV)
                                 goto out;
-                        }
                         /* Get another socket */
                         return 1;
                 }