Current code releases the cmd struct after its initial IO has completed. Any reply processing is done independently, using a separate qeth_reply struct. In preparation for merging the cmd and reply structs together, take an additional reference on the cmd object so that it stays around all the way until qeth_send_control_data() returns. Signed-off-by: Julian Wiedmann <jwi@xxxxxxxxxxxxx> --- drivers/s390/net/qeth_core_main.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c index 49e85d2e79c2..3fc14f222dc3 100644 --- a/drivers/s390/net/qeth_core_main.c +++ b/drivers/s390/net/qeth_core_main.c @@ -1742,6 +1742,9 @@ static int qeth_send_control_data(struct qeth_card *card, qeth_enqueue_reply(card, reply); + /* This pairs with iob->callback, and keeps the iob alive after IO: */ + qeth_get_cmd(iob); + QETH_CARD_TEXT(card, 6, "noirqpnd"); spin_lock_irq(get_ccwdev_lock(channel->ccwdev)); rc = ccw_device_start_timeout(channel->ccwdev, __ccw_from_cmd(iob), @@ -1752,11 +1755,10 @@ static int qeth_send_control_data(struct qeth_card *card, CARD_DEVID(card), rc); QETH_CARD_TEXT_(card, 2, " err%d", rc); qeth_dequeue_reply(card, reply); - qeth_put_reply(reply); qeth_put_cmd(iob); atomic_set(&channel->irq_pending, 0); wake_up(&card->wait_q); - return rc; + goto out; } timeout = wait_for_completion_interruptible_timeout(&reply->received, @@ -1777,7 +1779,10 @@ static int qeth_send_control_data(struct qeth_card *card, if (!rc) rc = reply->rc; + +out: qeth_put_reply(reply); + qeth_put_cmd(iob); return rc; } -- 2.17.1
