The reference taken by mpi3mr_get_tgtdev_by_handle() is only dropped
when tgtdev->starget and tgtdev->starget->hostdata are both valid, so
the reference is leaked when the SCSI target is being torn down and
starget has already been cleared.

Drop the reference unconditionally when the lookup succeeds.

Fixes: 506bc1a0d6ba ("scsi: mpi3mr: Add support for MPT commands")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/scsi/mpi3mr/mpi3mr_app.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/mpi3mr/mpi3mr_app.c b/drivers/scsi/mpi3mr/mpi3mr_app.c
index 1353a8ff9c85..e491ab7496cc 100644
--- a/drivers/scsi/mpi3mr/mpi3mr_app.c
+++ b/drivers/scsi/mpi3mr/mpi3mr_app.c
@@ -2741,8 +2741,9 @@ static long mpi3mr_bsg_process_mpt_cmds(struct bsg_job *job)
 			stgt_priv = (struct mpi3mr_stgt_priv_data *)
 			    tgtdev->starget->hostdata;
 			atomic_inc(&stgt_priv->block_io);
-			mpi3mr_tgtdev_put(tgtdev);
 		}
+		if (tgtdev)
+			mpi3mr_tgtdev_put(tgtdev);
 	}
 
 	mrioc->bsg_cmds.state = MPI3MR_CMD_PENDING;
-- 
2.34.1