diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
index 4030e1fa57e52db1e493af52ccc0faa112c01416..453f5a6fb96bc2553c1a994fc55b83fcfc84dfcb 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -1500,7 +1500,16 @@ void scsi_remove_target(struct device *dev)
 		    starget->state == STARGET_CREATED_REMOVE)
 			continue;
 		if (starget->dev.parent == dev || &starget->dev == dev) {
-			kref_get(&starget->reap_ref);
+			/*
+			 * If the reference count is already zero, skip
+			 * this target. Calling kref_get_unless_zero() if
+			 * the reference count is zero is safe because
+			 * scsi_target_destroy() will wait until the host
+			 * lock has been released before freeing starget.
+			 */
+			if (!kref_get_unless_zero(&starget->reap_ref))
+				continue;
+
 			if (starget->state == STARGET_CREATED)
 				starget->state = STARGET_CREATED_REMOVE;
 			else