1 files changed, 14 insertions, 14 deletions

diff --git a/net/9p/client.c b/net/9p/client.c
index 0a04faa22116..4b529454616d 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -189,6 +189,9 @@ static struct p9_req_t *p9_tag_alloc(struct p9_client *c, u16 tag)
                         printk(KERN_ERR "Couldn't grow tag array\n");
                         kfree(req->tc);
                         kfree(req->rc);
+                        kfree(req->wq);
+                        req->tc = req->rc = NULL;
+                        req->wq = NULL;
                         return ERR_PTR(-ENOMEM);
                 }
                 req->tc->sdata = (char *) req->tc + sizeof(struct p9_fcall);
@@ -311,12 +314,6 @@ static void p9_free_req(struct p9_client *c, struct p9_req_t *r)
         r->status = REQ_STATUS_IDLE;
         if (tag != P9_NOTAG && p9_idpool_check(tag, c->tagpool))
                 p9_idpool_put(tag, c->tagpool);
-
-        /* if this was a flush request we have to free response fcall */
-        if (r->rc->id == P9_RFLUSH) {
-                kfree(r->tc);
-                kfree(r->rc);
-        }
 }
 
 /**
@@ -611,19 +608,21 @@ reterr:
 
 static struct p9_fid *p9_fid_create(struct p9_client *clnt)
 {
-        int err;
+        int ret;
         struct p9_fid *fid;
+        unsigned long flags;
 
         P9_DPRINTK(P9_DEBUG_FID, "clnt %p\n", clnt);
         fid = kmalloc(sizeof(struct p9_fid), GFP_KERNEL);
         if (!fid)
                 return ERR_PTR(-ENOMEM);
 
-        fid->fid = p9_idpool_get(clnt->fidpool);
+        ret = p9_idpool_get(clnt->fidpool);
         if (fid->fid < 0) {
-                err = -ENOSPC;
+                ret = -ENOSPC;
                 goto error;
         }
+        fid->fid = ret;
 
         memset(&fid->qid, 0, sizeof(struct p9_qid));
         fid->mode = -1;
@@ -632,27 +631,28 @@ static struct p9_fid *p9_fid_create(struct p9_client *clnt)
         fid->clnt = clnt;
         fid->aux = NULL;
 
-        spin_lock(&clnt->lock);
+        spin_lock_irqsave(&clnt->lock, flags);
         list_add(&fid->flist, &clnt->fidlist);
-        spin_unlock(&clnt->lock);
+        spin_unlock_irqrestore(&clnt->lock, flags);
 
         return fid;
 
 error:
         kfree(fid);
-        return ERR_PTR(err);
+        return ERR_PTR(ret);
 }
 
 static void p9_fid_destroy(struct p9_fid *fid)
 {
         struct p9_client *clnt;
+        unsigned long flags;
 
         P9_DPRINTK(P9_DEBUG_FID, "fid %d\n", fid->fid);
         clnt = fid->clnt;
         p9_idpool_put(fid->fid, clnt->fidpool);
-        spin_lock(&clnt->lock);
+        spin_lock_irqsave(&clnt->lock, flags);
         list_del(&fid->flist);
-        spin_unlock(&clnt->lock);
+        spin_unlock_irqrestore(&clnt->lock, flags);
         kfree(fid);
 }