scsi: bnx2fc: fix bnx2fc_cmd refcount imbalance in send_rec

If cb_arg alloc failed, we can't release the struct orig_io_req refcount
before we take its refcount. As Saurav said, move the rec_err label down
to avoid unnecessary refcount release and nullptr free.

Signed-off-by: Lin Yi <teroincn@163.com>
Acked-by: Saurav Kashyap <skashyap@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/scsi/bnx2fc/bnx2fc_els.c b/drivers/scsi/bnx2fc/bnx2fc_els.c
index 8de5b70..9a8e40b 100644 (file)
--- a/drivers/scsi/bnx2fc/bnx2fc_els.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_els.c
@@ -610,7 +610,6 @@ int bnx2fc_send_rec(struct bnx2fc_cmd *orig_io_req)
        rc = bnx2fc_initiate_els(tgt, ELS_REC, &rec, sizeof(rec),
                                 bnx2fc_rec_compl, cb_arg,
                                 r_a_tov);
-rec_err:
        if (rc) {
                BNX2FC_IO_DBG(orig_io_req, "REC failed - release\n");
                spin_lock_bh(&tgt->tgt_lock);
@@ -618,6 +617,7 @@ rec_err:
                spin_unlock_bh(&tgt->tgt_lock);
                kfree(cb_arg);
        }
+rec_err:
        return rc;
 }