[PATCH] fix: nvmet: nvmet_sq_create: fix ctrl reference leak on nvmet_check_sqid failure

[WenTao Liang]

After kref_get_unless_zero successfully acquires a ctrl reference, the
  nvmet_check_sqid failure path returns the status directly without calling
  nvmet_ctrl_put, leaving the ctrl reference permanently leaked.

Add nvmet_ctrl_put before returning on the nvmet_check_sqid error path to
  properly release the acquired reference.

Cc: stable at vger.kernel.org
Fixes: a07b4970f464 ("nvmet: add a generic NVMe target")
Signed-off-by: WenTao Liang <vulab at iscas.ac.cn>
---
 drivers/nvme/target/core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
index 62dd59b9aa4f..52fc2dade4ea 100644
--- a/drivers/nvme/target/core.c
+++ b/drivers/nvme/target/core.c
@@ -943,8 +943,10 @@ u16 nvmet_sq_create(struct nvmet_ctrl *ctrl, struct nvmet_sq *sq,
 		return NVME_SC_INTERNAL | NVME_STATUS_DNR;
 
 	status = nvmet_check_sqid(ctrl, sqid, true);
-	if (status != NVME_SC_SUCCESS)
+	if (status != NVME_SC_SUCCESS) {
+		nvmet_ctrl_put(ctrl);
 		return status;
+	}
 
 	ret = nvmet_sq_init(sq, cq);
 	if (ret) {
-- 
2.39.5 (Apple Git-154)