nvmet_fc_alloc_target_assoc() takes a reference on the target port for
the new association, but nvmet_fc_target_assoc_free() never drops it.
The reference is only released by nvmet_fc_delete_target_assoc(), which
is not reached when nvmet_fc_alloc_target_queue() fails and the caller
tears the association down with nvmet_fc_tgt_a_put() alone, leaking the
target port reference.

Release the reference in the association destructor, which pairs with
the reference taken at allocation time, instead of in
nvmet_fc_delete_target_assoc().

Fixes: c53432030d86 ("nvme-fabrics: Add target support for FC transport")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/nvme/target/fc.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index d161707559ce..a6431f4c5420 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -1186,6 +1186,7 @@ nvmet_fc_target_assoc_free(struct kref *ref)
 	ida_free(&tgtport->assoc_cnt, assoc->a_id);
 	pr_info("{%d:%d}: Association freed\n",
 		tgtport->fc_target_port.port_num, assoc->a_id);
+	nvmet_fc_tgtport_put(tgtport);
 	kfree(assoc);
 }
 
@@ -1222,8 +1223,6 @@ nvmet_fc_delete_target_assoc(struct nvmet_fc_tgt_assoc *assoc)
 
 	pr_info("{%d:%d}: Association deleted\n",
 		tgtport->fc_target_port.port_num, assoc->a_id);
-
-	nvmet_fc_tgtport_put(tgtport);
 }
 
 static struct nvmet_fc_tgt_assoc *
-- 
2.34.1