scsi: lpfc: Fix ndlp put following a LOGO completion

During testing with repeated asynchronous resets of the target, an issue
was found when the driver issues a LOGO to disconnect its login and recover
all exchanges. The LOGO command takes a node reference but neglects to
remove it, keeping the node reference count artifically high.

Add a call to lpfc_nlp_put() to lpfc_nlp_logo_unreg() and move the mempool
free call to the routine exit along with the needed put.  This is always
safe as this will not be the last reference removed as lpfc_unreg_rpi()
ensures there is an additional reference on the ndlp.

Link: https://lore.kernel.org/r/20220506035519.50908-4-jsmart2021@gmail.com
Co-developed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
index 2d84625..e480510 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
@@ -5235,7 +5235,6 @@ lpfc_nlp_logo_unreg(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
        if (!ndlp)
                return;
        lpfc_issue_els_logo(vport, ndlp, 0);
-       mempool_free(pmb, phba->mbox_mem_pool);
 
        /* Check to see if there are any deferred events to process */
        if ((ndlp->nlp_flag & NLP_UNREG_INP) &&
@@ -5262,6 +5261,13 @@ lpfc_nlp_logo_unreg(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
                ndlp->nlp_flag &= ~NLP_UNREG_INP;
                spin_unlock_irq(&ndlp->lock);
        }
+
+       /* The node has an outstanding reference for the unreg. Now
+        * that the LOGO action and cleanup are finished, release
+        * resources.
+        */
+       lpfc_nlp_put(ndlp);
+       mempool_free(pmb, phba->mbox_mem_pool);
 }
 
 /*