--- zzzz-none-000/linux-2.6.19.2/drivers/scsi/iscsi_tcp.c	2007-01-10 19:10:37.000000000 +0000
+++ davinci-8020-5505/linux-2.6.19.2/drivers/scsi/iscsi_tcp.c	2007-01-11 07:38:19.000000000 +0000
@@ -415,8 +415,8 @@
 	iscsi_solicit_data_init(conn, ctask, r2t);
 
 	tcp_ctask->exp_r2tsn = r2tsn + 1;
-	__kfifo_put(tcp_ctask->r2tqueue, (void*)&r2t, sizeof(void*));
 	tcp_ctask->xmstate |= XMSTATE_SOL_HDR;
+	__kfifo_put(tcp_ctask->r2tqueue, (void*)&r2t, sizeof(void*));
 	list_move_tail(&ctask->running, &conn->xmitqueue);
 
 	scsi_queue_work(session->host, &conn->xmitwork);
@@ -1627,12 +1627,9 @@
 	if (tcp_ctask->xmstate & XMSTATE_SOL_HDR) {
 		tcp_ctask->xmstate &= ~XMSTATE_SOL_HDR;
 		tcp_ctask->xmstate |= XMSTATE_SOL_DATA;
-		if (!tcp_ctask->r2t) {
-			spin_lock_bh(&session->lock);
+		if (!tcp_ctask->r2t)
 			__kfifo_get(tcp_ctask->r2tqueue, (void*)&tcp_ctask->r2t,
 				    sizeof(void*));
-			spin_unlock_bh(&session->lock);
-		}
 send_hdr:
 		r2t = tcp_ctask->r2t;
 		dtask = &r2t->dtask;
@@ -1819,14 +1816,21 @@
 {
 	struct iscsi_conn *conn = cls_conn->dd_data;
 	struct iscsi_tcp_conn *tcp_conn = conn->dd_data;
+	int digest = 0;
+
+	if (conn->hdrdgst_en || conn->datadgst_en)
+		digest = 1;
 
 	iscsi_tcp_release_conn(conn);
 	iscsi_conn_teardown(cls_conn);
 
-	if (tcp_conn->tx_hash.tfm)
-		crypto_free_hash(tcp_conn->tx_hash.tfm);
-	if (tcp_conn->rx_hash.tfm)
-		crypto_free_hash(tcp_conn->rx_hash.tfm);
+	/* now free tcp_conn */
+	if (digest) {
+		if (tcp_conn->tx_hash.tfm)
+			crypto_free_hash(tcp_conn->tx_hash.tfm);
+		if (tcp_conn->rx_hash.tfm)
+			crypto_free_hash(tcp_conn->rx_hash.tfm);
+	}
 
 	kfree(tcp_conn);
 }