[BUG] drivers: target: does there exist a memleak in function core_scsi3_emulate_pro_register_and_move

[亿一 <teroincn@xxxxxxxxx>]

Hi, all:
When reviewing the code of function
core_scsi3_emulate_pro_register_and_move, the object dest_se_tpg
refcnt increased by atomic_inc_mb (&dest_se_tpg->tpg_pr_ref_count);
however if buf allocated by transport_kmap_data_sg is failed, we goto
out_put_pr_reg without release the reference of dest_se_tpg, it leak
reference of dest_se_tpg.

static sense_reason_t
core_scsi3_emulate_pro_register_and_move(struct se_cmd *cmd, u64 res_key,
u64 sa_res_key, int aptpl, int unreg)
{
      list_for_each_entry(tmp_lun, &dev->dev_sep_list, lun_dev_link) {

            dest_se_tpg = tmp_lun->lun_tpg;
            dest_tf_ops = dest_se_tpg->se_tpg_tfo;
            if (!dest_tf_ops)
                  continue;

            atomic_inc_mb(&dest_se_tpg->tpg_pr_ref_count);
            spin_unlock(&dev->se_port_lock);

            if (core_scsi3_tpg_depend_item(dest_se_tpg)) {
                  .....
                 atomic_dec_mb(&dest_se_tpg->tpg_pr_ref_count);
                 .....
                goto out_put_pr_reg;
             }

            spin_lock(&dev->se_port_lock);
            break;
      }
     spin_unlock(&dev->se_port_lock);

      if (!dest_se_tpg || !dest_tf_ops) {
           ......
           goto out_put_pr_reg;
      }

      buf = transport_kmap_data_sg(cmd);
      if (!buf) {
            ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
           goto out_put_pr_reg;
      }

      out_put_pr_reg:
            core_scsi3_put_pr_reg(pr_reg);
            return ret;
      }