scsi_device_lookup_by_target() returns the scsi_device with an extra
reference that the caller has to drop with scsi_device_put().  The
loop that looks for a tape device to enable inline data padding
never releases that reference, neither when it breaks out on a
match nor when it keeps iterating over the other target ids, so a
reference is leaked on every write of the device page.

Drop the reference in both cases.

Fixes: 19fff154e7ee ("[SCSI] mptfusion: Adding inline data padding support for TAPE drive.")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/message/fusion/mptspi.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/message/fusion/mptspi.c b/drivers/message/fusion/mptspi.c
index 56892b1f3de2..89d6beba08ca 100644
--- a/drivers/message/fusion/mptspi.c
+++ b/drivers/message/fusion/mptspi.c
@@ -914,8 +914,12 @@ static int mptspi_write_spi_device_pg1(struct scsi_target *starget,
 				nego_parms |= MPI_SCSIDEVPAGE1_RP_IDP;
 				pg1->RequestedParameters =
 				    cpu_to_le32(nego_parms);
+				scsi_device_put(sdev);
 				break;
 			}
+
+			if (sdev)
+				scsi_device_put(sdev);
 		}
 	}
 
-- 
2.34.1