On Fri, 2018-03-02 at 11:31 +0800, Jianchao Wang wrote: > diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c > index a86df9c..d2f1838 100644 > --- a/drivers/scsi/scsi_lib.c > +++ b/drivers/scsi/scsi_lib.c > @@ -191,7 +191,13 @@ static void __scsi_queue_insert(struct scsi_cmnd *cmd, int reason, bool unbusy) > */ > cmd->result = 0; > if (q->mq_ops) { > - scsi_mq_requeue_cmd(cmd); > + /* > + * scsi_device.sdev_gendev will be get every time in .get_budget and > + * be put in scsi_end_request. Hence we need to put the reference > + * here when we decide to requeue request. > + */ > + blk_mq_requeue_request(cmd->request, true); > + put_device(&device->sdev_gendev); > return; > } > spin_lock_irqsave(q->queue_lock, flags); Please consider to change the new comment into something like the following: "Before a SCSI command is dispatched, get_device(&sdev->sdev_gendev) is called and the host, target and device busy counters are increased. Since requeuing a request causes these actions to be repeated and since scsi_device_unbusy() has already been called, put_device(&device->sdev_gendev) must still be called. Call put_device() after blk_mq_requeue_request() to avoid that removal of the SCSI device can start before requeueing has happened." Thanks, Bart.