3 files changed, 18 insertions, 13 deletions

diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 9d7bbd225eff..e567f4e6196a 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -1070,7 +1070,7 @@ CIFSSMBRead(const int xid, struct cifsTconInfo *tcon,
                 }
         }
 
-        cifs_small_buf_release(pSMB);
+/*      cifs_small_buf_release(pSMB); */ /* Freed earlier now in SendReceive2 */
         if(*buf) {
                 if(resp_buf_type == CIFS_SMALL_BUFFER)
                         cifs_small_buf_release(iov[0].iov_base);
@@ -1274,7 +1274,7 @@ CIFSSMBWrite2(const int xid, struct cifsTconInfo *tcon,
                 *nbytes += le16_to_cpu(pSMBr->Count);
         } 
 
-        cifs_small_buf_release(pSMB);
+/*      cifs_small_buf_release(pSMB); */ /* Freed earlier now in SendReceive2 */
         if(resp_buf_type == CIFS_SMALL_BUFFER)
                 cifs_small_buf_release(iov[0].iov_base);
         else if(resp_buf_type == CIFS_LARGE_BUFFER)
@@ -2606,7 +2606,7 @@ qsec_out:
                 cifs_small_buf_release(iov[0].iov_base);
         else if(buf_type == CIFS_LARGE_BUFFER)
                 cifs_buf_release(iov[0].iov_base);
-        cifs_small_buf_release(pSMB);
+/*      cifs_small_buf_release(pSMB); */ /* Freed earlier now in SendReceive2 */
         return rc;
 }
 
diff --git a/fs/cifs/ntlmssp.c b/fs/cifs/ntlmssp.c
index 4aabe2d7cb7b..78866f925747 100644
--- a/fs/cifs/ntlmssp.c
+++ b/fs/cifs/ntlmssp.c
@@ -122,8 +122,7 @@ CIFS_SessSetup(unsigned int xid, struct cifsSesInfo *ses, const int type,
 
 
 /*      rc = SendReceive2(xid, ses, iov, num_iovecs, &resp_buf_type, 0); */
-
-        cifs_small_buf_release(smb_buffer);
+        /* SMB request buf freed in SendReceive2 */
 
         return rc;
 }
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index b12cb8a7da7c..3da80409466c 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -309,17 +309,16 @@ SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
         
         *pRespBufType = CIFS_NO_BUFFER;  /* no response buf yet */
 
-        if (ses == NULL) {
-                cERROR(1,("Null smb session"));
-                return -EIO;
-        }
-        if(ses->server == NULL) {
-                cERROR(1,("Null tcp session"));
+        if ((ses == NULL) || (ses->server == NULL)) {
+                cifs_small_buf_release(in_buf);
+                cERROR(1,("Null session"));
                 return -EIO;
         }
 
-        if(ses->server->tcpStatus == CifsExiting)
+        if(ses->server->tcpStatus == CifsExiting) {
+                cifs_small_buf_release(in_buf);
                 return -ENOENT;
+        }
 
         /* Ensure that we do not send more than 50 overlapping requests 
            to the same server. We may make this configurable later or
@@ -346,6 +345,7 @@ SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
                         } else {
                                 if(ses->server->tcpStatus == CifsExiting) {
                                         spin_unlock(&GlobalMid_Lock);
+                                        cifs_small_buf_release(in_buf);
                                         return -ENOENT;
                                 }
 
@@ -385,6 +385,7 @@ SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
         midQ = AllocMidQEntry(in_buf, ses);
         if (midQ == NULL) {
                 up(&ses->server->tcpSem);
+                cifs_small_buf_release(in_buf);
                 /* If not lock req, update # of requests on wire to server */
                 if(long_op < 3) {
                         atomic_dec(&ses->server->inFlight); 
@@ -408,14 +409,18 @@ SendReceive2(const unsigned int xid, struct cifsSesInfo *ses,
         if(rc < 0) {
                 DeleteMidQEntry(midQ);
                 up(&ses->server->tcpSem);
+                cifs_small_buf_release(in_buf);
                 /* If not lock req, update # of requests on wire to server */
                 if(long_op < 3) {
                         atomic_dec(&ses->server->inFlight); 
                         wake_up(&ses->server->request_q);
                 }
                 return rc;
-        } else
+        } else {
                 up(&ses->server->tcpSem);
+                cifs_small_buf_release(in_buf);
+        }
+
         if (long_op == -1)
                 goto cifs_no_response_exit2;
         else if (long_op == 2) /* writes past end of file can take loong time */
@@ -543,6 +548,7 @@ cifs_no_response_exit2:
 
 out_unlock2:
         up(&ses->server->tcpSem);
+        cifs_small_buf_release(in_buf);
         /* If not lock req, update # of requests on wire to server */
         if(long_op < 3) {
                 atomic_dec(&ses->server->inFlight);