--- drivers/ata/libata-scsi.c

+++ drivers/ata/libata-scsi.c

@@ -2497,8 +2497,11 @@ static void atapi_qc_complete(struct ata

*

* If door lock fails, always clear sdev->locked to

* avoid this infinite loop.

+ *

+ * This may happen before SCSI scan is complete. Make

+ * sure qc->dev->sdev isn't NULL before dereferencing.

*/

- if (qc->cdb[0] == ALLOW_MEDIUM_REMOVAL)

+ if (qc->cdb[0] == ALLOW_MEDIUM_REMOVAL && qc->dev->sdev)

qc->dev->sdev->locked = 0;

qc->scsicmd->result = SAM_STAT_CHECK_CONDITION;

@@ -2825,7 +2828,7 @@ static unsigned int ata_scsi_pass_thru(s

* write indication (used for PIO/DMA setup), result TF is

* copied back and we don't whine too much about its failure.

*/

- tf->flags = ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;

+ tf->flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;

if (scmd->sc_data_direction == DMA_TO_DEVICE)

tf->flags |= ATA_TFLAG_WRITE;