[PATCH] scsi: mpt3sas: fix refcount leak in mpt3sas_transport_port_add()

[WenTao Liang]

In mpt3sas_transport_port_add(), after acquiring the sas_device by
calling mpt3sas_get_sdev_by_addr() (which bumps the reference count via
sas_device_get()), several error paths leak the reference.  If
sas_node->parent_dev is NULL, or port creation/sas_port_add() fails, or
rphy allocation or sas_rphy_add() fails, the function jumps to out_fail
or out_delete_port, where the sas_device reference is not released.  The
reference is only dropped on the success path via sas_device_put().

Add the missing sas_device_put() call in the out_fail cleanup, which
also covers the out_delete_port label that falls through to out_fail.
This fixes the leak for all error paths that occur after the sas_device
is acquired.  Before that point, sas_device is NULL, so the put is safe.

Cc: stable@xxxxxxxxxxxxxxx
Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS")
Signed-off-by: WenTao Liang <vulab@xxxxxxxxxxx>
---
 drivers/scsi/mpt3sas/mpt3sas_transport.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c
index e74a526efa8d..f831d4823503 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c
@@ -869,6 +869,8 @@ mpt3sas_transport_port_add(struct MPT3SAS_ADAPTER *ioc, u16 handle,
 	list_for_each_entry_safe(mpt3sas_phy, next, &mpt3sas_port->phy_list,
 	    port_siblings)
 		list_del(&mpt3sas_phy->port_siblings);
+	if (sas_device)
+		sas_device_put(sas_device);
 	kfree(mpt3sas_port);
 	return NULL;
 }
-- 
2.50.1 (Apple Git-155)