diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h
index 9ab7090f7c83..48de996ad28d 100644
--- a/drivers/target/target_core_internal.h
+++ b/drivers/target/target_core_internal.h
@@ -146,6 +146,7 @@ int	transport_dump_vpd_assoc(struct t10_vpd *, unsigned char *, int);
 int	transport_dump_vpd_ident_type(struct t10_vpd *, unsigned char *, int);
 int	transport_dump_vpd_ident(struct t10_vpd *, unsigned char *, int);
 void	transport_clear_lun_ref(struct se_lun *);
+int	__target_put_sess_cmd(struct se_cmd *se_cmd);
 void	transport_send_task_abort(struct se_cmd *);
 sense_reason_t	target_cmd_size_check(struct se_cmd *cmd, unsigned int size);
 void	target_qf_do_work(struct work_struct *work);
diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
index 367799b4dde1..161c8b8482db 100644
--- a/drivers/target/target_core_tmr.c
+++ b/drivers/target/target_core_tmr.c
@@ -188,7 +188,7 @@ void core_tmr_abort_task(
 		if (!tmr->tmr_dev &&
 		    transport_lookup_tmr_lun(tmr->task_cmd,
 					     se_cmd->orig_fe_lun) < 0) {
-			target_put_sess_cmd(se_cmd);
+			__target_put_sess_cmd(se_cmd);
 			continue;
 		}
 
@@ -199,7 +199,7 @@ void core_tmr_abort_task(
 		transport_wait_for_tasks(se_cmd);
 
 		transport_cmd_finish_abort(se_cmd, true);
-		target_put_sess_cmd(se_cmd);
+		__target_put_sess_cmd(se_cmd);
 
 		printk("ABORT_TASK: Sending TMR_FUNCTION_COMPLETE for"
 				" ref_tag: %llu\n", ref_tag);
@@ -299,7 +299,7 @@ static void core_tmr_drain_tmr_list(
 		transport_wait_for_tasks(cmd);
 
 		transport_cmd_finish_abort(cmd, 1);
-		target_put_sess_cmd(cmd);
+		__target_put_sess_cmd(cmd);
 	}
 }
 
@@ -398,7 +398,7 @@ static void core_tmr_drain_state_list(
 		transport_wait_for_tasks(cmd);
 
 		core_tmr_handle_tas_abort(cmd, tas);
-		target_put_sess_cmd(cmd);
+		__target_put_sess_cmd(cmd);
 	}
 }
 
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 8f2169e92771..533b584c2806 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1217,6 +1217,7 @@ void transport_init_se_cmd(
 	init_completion(&cmd->cmd_wait_comp);
 	spin_lock_init(&cmd->t_state_lock);
 	kref_init(&cmd->cmd_kref);
+	atomic_set(&cmd->tgt_ref, 1);
 	cmd->transport_state = CMD_T_DEV_ACTIVE;
 
 	cmd->se_tfo = tfo;
@@ -2554,6 +2555,7 @@ int target_get_sess_cmd(struct se_cmd *se_cmd, bool ack_kref)
 		if (!kref_get_unless_zero(&se_cmd->cmd_kref))
 			return -EINVAL;
 
+		atomic_inc(&se_cmd->tgt_ref);
 		se_cmd->se_cmd_flags |= SCF_ACK_KREF;
 	}
 
@@ -2590,6 +2592,8 @@ static void target_release_cmd_kref(struct kref *kref)
 	unsigned long flags;
 	bool fabric_stop;
 
+	WARN_ON_ONCE(atomic_read(&se_cmd->tgt_ref) != 0);
+
 	if (se_sess) {
 		spin_lock_irqsave(&se_sess->sess_cmd_lock, flags);
 
@@ -2614,15 +2618,29 @@ static void target_release_cmd_kref(struct kref *kref)
 }
 
 /**
+ * __target_put_sess_cmd - drop a reference obtained by kref_get_unless_zero()
+ */
+int __target_put_sess_cmd(struct se_cmd *se_cmd)
+{
+	return kref_put(&se_cmd->cmd_kref, target_release_cmd_kref);
+}
+
+/**
  * target_put_sess_cmd - decrease the command reference count
- * @se_cmd:	command to drop a reference from
+ * @se_cmd: Drop a reference obtained by target_get_sess_cmd().
  *
  * Returns 1 if and only if this target_put_sess_cmd() call caused the
  * refcount to drop to zero. Returns zero otherwise.
  */
 int target_put_sess_cmd(struct se_cmd *se_cmd)
 {
-	return kref_put(&se_cmd->cmd_kref, target_release_cmd_kref);
+	long ref = atomic_dec_return(&se_cmd->tgt_ref);
+
+	WARN_ON_ONCE(ref < 0);
+	if (ref == 0)
+		complete(&se_cmd->complete);
+
+	return __target_put_sess_cmd(se_cmd);
 }
 EXPORT_SYMBOL(target_put_sess_cmd);
 
@@ -2680,7 +2698,7 @@ void target_wait_for_sess_cmds(struct se_session *se_sess)
 		tas = (se_cmd->transport_state & CMD_T_TAS);
 		spin_unlock_irqrestore(&se_cmd->t_state_lock, flags);
 
-		if (!target_put_sess_cmd(se_cmd)) {
+		if (!__target_put_sess_cmd(se_cmd)) {
 			if (tas)
 				target_put_sess_cmd(se_cmd);
 		}
diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
index fb87f0e5d0d6..c84e5eecb94d 100644
--- a/include/target/target_core_base.h
+++ b/include/target/target_core_base.h
@@ -495,7 +495,9 @@ struct se_cmd {
 #define CMD_T_FABRIC_STOP	(1 << 11)
 	spinlock_t		t_state_lock;
 	struct kref		cmd_kref;
+	atomic_t		tgt_ref;
 	struct completion	t_transport_stop_comp;
+	struct completion	complete;
 
 	struct work_struct	work;
 
