[PATCH] scsi: mpi3mr: Fix tgtdev reference leak in mpi3mr_dev_rmhs_send_tm()

[Wentao Liang]

__mpi3mr_get_tgtdev_by_handle() takes a reference on the target device,
but mpi3mr_dev_rmhs_send_tm() never drops it on any of its return paths.
The completion callbacks only track the device handle, so the reference
is leaked for every device removal handshake.

Release the reference once the device state has been updated.

Fixes: 3f1254ed01d0 ("scsi: mpi3mr: Successive VD delete and add causes FW fault")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/scsi/mpi3mr/mpi3mr_os.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/scsi/mpi3mr/mpi3mr_os.c b/drivers/scsi/mpi3mr/mpi3mr_os.c
index 402d1f35d214..8a2575171e1f 100644
--- a/drivers/scsi/mpi3mr/mpi3mr_os.c
+++ b/drivers/scsi/mpi3mr/mpi3mr_os.c
@@ -2520,6 +2520,8 @@ static void mpi3mr_dev_rmhs_send_tm(struct mpi3mr_ioc *mrioc, u16 handle,
 	if (tgtdev && (iou_rc == MPI3_CTRL_OP_REMOVE_DEVICE))
 		tgtdev->state = MPI3MR_DEV_REMOVE_HS_STARTED;
 	spin_unlock_irqrestore(&mrioc->tgtdev_lock, flags);
+	if (tgtdev)
+		mpi3mr_tgtdev_put(tgtdev);
 
 	if (drv_cmd)
 		goto issue_cmd;
-- 
2.34.1