diff --git a/[refs] b/[refs]
index 2af2bd26e2ea..b502d55465a9 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 08bd34c98d631fe85744d4c920c80f48a1d95f54
+refs/heads/master: 0244f57302f7e8bebd2f1ab58767eac2e9f678a6
diff --git a/trunk/drivers/firewire/core-cdev.c b/trunk/drivers/firewire/core-cdev.c
index 8cbc2b8a8272..8f8c8eeaf046 100644
--- a/trunk/drivers/firewire/core-cdev.c
+++ b/trunk/drivers/firewire/core-cdev.c
@@ -627,6 +627,8 @@ static void release_request(struct client *client,
 		kfree(r->data);
 	else
 		fw_send_response(r->card, r->request, RCODE_CONFLICT_ERROR);
+
+	fw_card_put(r->card);
 	kfree(r);
 }
 
@@ -641,6 +643,9 @@ static void handle_request(struct fw_card *card, struct fw_request *request,
 	void *fcp_frame = NULL;
 	int ret;
 
+	/* card may be different from handler->client->device->card */
+	fw_card_get(card);
+
 	r = kmalloc(sizeof(*r), GFP_ATOMIC);
 	e = kmalloc(sizeof(*e), GFP_ATOMIC);
 	if (r == NULL || e == NULL)
@@ -686,6 +691,8 @@ static void handle_request(struct fw_card *card, struct fw_request *request,
 
 	if (!is_fcp_request(request))
 		fw_send_response(card, request, RCODE_CONFLICT_ERROR);
+
+	fw_card_put(card);
 }
 
 static void release_address_handler(struct client *client,
@@ -768,6 +775,7 @@ static int ioctl_send_response(struct client *client, union ioctl_arg *arg)
 	}
 	fw_send_response(r->card, r->request, a->rcode);
  out:
+	fw_card_put(r->card);
 	kfree(r);
 
 	return ret;