1 files changed, 4 insertions, 3 deletions

diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index 0219b5a865be..f29d600357f3 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -1216,7 +1216,7 @@ static void tcmu_set_next_deadline(struct list_head *queue,
                 del_timer(timer);
 }
 
-static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
+static bool tcmu_handle_completions(struct tcmu_dev *udev)
 {
         struct tcmu_mailbox *mb;
         struct tcmu_cmd *cmd;
@@ -1256,7 +1256,7 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
                         pr_err("cmd_id %u not found, ring is broken\n",
                                entry->hdr.cmd_id);
                         set_bit(TCMU_DEV_BIT_BROKEN, &udev->flags);
-                        break;
+                        return false;
                 }
 
                 tcmu_handle_completion(cmd, entry);
@@ -1499,6 +1499,7 @@ static struct page *tcmu_try_get_block_page(struct tcmu_dev *udev, uint32_t dbi)
         mutex_lock(&udev->cmdr_lock);
         page = tcmu_get_block_page(udev, dbi);
         if (likely(page)) {
+                get_page(page);
                 mutex_unlock(&udev->cmdr_lock);
                 return page;
         }
@@ -1537,6 +1538,7 @@ static vm_fault_t tcmu_vma_fault(struct vm_fault *vmf)
                 /* For the vmalloc()ed cmd area pages */
                 addr = (void *)(unsigned long)info->mem[mi].addr + offset;
                 page = vmalloc_to_page(addr);
+                get_page(page);
         } else {
                 uint32_t dbi;
 
@@ -1547,7 +1549,6 @@ static vm_fault_t tcmu_vma_fault(struct vm_fault *vmf)
                         return VM_FAULT_SIGBUS;
         }
 
-        get_page(page);
         vmf->page = page;
         return 0;
 }