[PATCH v2 1/3] scsi: lpfc: Fix ndlp reference leak in lpfc_release_rpi()

[Wentao Liang <vulab@iscas.ac.cn>]

lpfc_release_rpi() only drops the node reference and frees the mailbox
memory it took when lpfc_sli_issue_mbox() returns MBX_NOT_FINISHED.  The
SLI-4 issue path can also return -EIO for a command it refuses to
submit, in which case the completion handler never runs and both the
reference and the mailbox are leaked.

Clean up whenever the command was not handed to the port.

The candidate came from a static analysis tool we run over the tree.
DeepSeek and GPT-6.1 Sol were used to audit the finding and to help
write the fix; I reviewed the result line by line and I am responsible
for it.

Fixes: 4430f7fd09ec ("scsi: lpfc: Rework locations of ndlp reference taking")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
Changes in v2:
 - Rebased on v7.4-rc1.
 - Reworded the comment above the check so that it does not depend on the
   SLI-4 return value.  The check itself is unchanged.
 - Sorry for the month it took me to answer the review.

 drivers/scsi/lpfc/lpfc_nportdisc.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
index fb8844c69491..fbe3c97723b2 100644
--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
@@ -1155,7 +1155,11 @@ lpfc_release_rpi(struct lpfc_hba *phba, struct lpfc_vport *vport,
 				 ndlp->nlp_rpi, ndlp->nlp_DID, ndlp->nlp_flag);
 
 		rc = lpfc_sli_issue_mbox(phba, pmb, MBX_NOWAIT);
-		if (rc == MBX_NOT_FINISHED) {
+		/* The completion handler frees the mailbox and drops the node
+		 * reference, and it only runs when the command was queued or
+		 * already completed.
+		 */
+		if (rc != MBX_SUCCESS && rc != MBX_BUSY) {
 			lpfc_nlp_put(ndlp);
 			mempool_free(pmb, phba->mbox_mem_pool);
 		}