fc_vport_setup() initializes the embedded device with device_initialize().
After that point, the device is managed by the driver core reference
counting rules. The initial reference should be dropped with
put_device().

The error path currently releases dev->parent and frees the fc_vport
directly. This bypasses fc_vport_dev_release(), leaving the embedded
device lifetime outside the driver core release path.

Keep the existing unwind of the transport and fc_host bookkeeping, but
drop the device reference with put_device(). The release callback will
release the parent device reference and free the fc_vport object. This
issue was found by a static analysis tool I am developing.

Fixes: a53eb5e060c0 ("[SCSI] FC Transport support for vports based on NPIV")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/scsi/scsi_transport_fc.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index dce95e361daf..04b754907587 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -3982,8 +3982,7 @@ fc_vport_setup(struct Scsi_Host *shost, int channel, struct device *pdev,
 	scsi_host_put(shost);			/* for fc_host->vport list */
 	fc_host->npiv_vports_inuse--;
 	spin_unlock_irqrestore(shost->host_lock, flags);
-	put_device(dev->parent);
-	kfree(vport);
+	put_device(dev);
 
 	return error;
 }
-- 
2.43.0