mpi3mr_get_tgtdev_by_addr() takes a reference on the target device for SAS end devices, and it is only dropped on the success path. When the function bails out to out_fail, for example because the parent device is missing or sas_port_add() fails, the reference is never released and the target device is leaked. Drop the reference on the out_fail path. Fixes: 42fc9fee116f ("scsi: mpi3mr: Add helper functions to manage device's port") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang --- drivers/scsi/mpi3mr/mpi3mr_transport.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/mpi3mr/mpi3mr_transport.c b/drivers/scsi/mpi3mr/mpi3mr_transport.c index a95c9352e859..5a0bc11a23c7 100644 --- a/drivers/scsi/mpi3mr/mpi3mr_transport.c +++ b/drivers/scsi/mpi3mr/mpi3mr_transport.c @@ -1501,6 +1501,8 @@ static struct mpi3mr_sas_port *mpi3mr_sas_port_add(struct mpi3mr_ioc *mrioc, list_for_each_entry_safe(mr_sas_phy, next, &mr_sas_port->phy_list, port_siblings) list_del(&mr_sas_phy->port_siblings); + if (tgtdev) + mpi3mr_tgtdev_put(tgtdev); kfree(mr_sas_port); return NULL; } -- 2.34.1