scsi: bnx2fc: fix bnx2fc_cmd refcount imbalance in send_rec

If cb_arg alloc failed, we can't release the struct orig_io_req refcount
before we take its refcount. As Saurav said, move the rec_err label down
to avoid unnecessary refcount release and nullptr free.

Signed-off-by: Lin Yi <[e-mail]>
Acked-by: Saurav Kashyap <[e-mail]>
Signed-off-by: Martin K. Petersen <[e-mail]>

drivers/scsi/bnx2fc/bnx2fc_els.c

···
 	rc = bnx2fc_initiate_els(tgt, ELS_REC, &rec, sizeof(rec),
 				 bnx2fc_rec_compl, cb_arg,
 				 r_a_tov);
-rec_err:
 	if (rc) {
 		BNX2FC_IO_DBG(orig_io_req, "REC failed - release\n");
 		spin_lock_bh(&tgt->tgt_lock);
···
 		spin_unlock_bh(&tgt->tgt_lock);
 		kfree(cb_arg);
 	}
+rec_err:
 	return rc;
 }