lpfc_issue_ct_rsp() stores the reference returned by lpfc_nlp_get() in dd_data so that the completion handler can drop it, but when lpfc_readl() fails the function bails out to issue_ct_rsp_exit and frees dd_data without dropping that reference, leaking the node. Release the node on that error path too. Fixes: 4430f7fd09ec ("scsi: lpfc: Rework locations of ndlp reference taking") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang --- drivers/scsi/lpfc/lpfc_bsg.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/scsi/lpfc/lpfc_bsg.c b/drivers/scsi/lpfc/lpfc_bsg.c index 7406dfa60016..f9e9896c348b 100644 --- a/drivers/scsi/lpfc/lpfc_bsg.c +++ b/drivers/scsi/lpfc/lpfc_bsg.c @@ -1545,6 +1545,7 @@ lpfc_issue_ct_rsp(struct lpfc_hba *phba, struct bsg_job *job, uint32_t tag, if (phba->cfg_poll & DISABLE_FCP_RING_INT) { if (lpfc_readl(phba->HCregaddr, &creg_val)) { rc = -IOCB_ERROR; + lpfc_nlp_put(dd_data->context_un.iocb.ndlp); goto issue_ct_rsp_exit; } creg_val |= (HC_R0INT_ENA << LPFC_FCP_RING); -- 2.34.1