[PATCH] scsi: target: iscsi: Clear sequence list after PDU allocation failure

[Ruoyu Wang]

iscsit_build_pdu_and_seq_lists() publishes cmd->seq_list after the
sequence-list allocation succeeds. If the later PDU-list allocation
fails, the error path frees the local seq pointer and returns with
cmd->seq_list still pointing at that freed memory.

The same command is then converted into a reject command, and its normal
release path frees cmd->seq_list again. Clear the published sequence-list
state after freeing seq so command release does not see a stale cleanup
pointer.

This issue was found by a static analysis checker and confirmed by
manual source review.
Fixes: e48354ce078c ("iscsi-target: Add iSCSI fabric support for target v4.1")
Signed-off-by: Ruoyu Wang <ruoyuw560@xxxxxxxxx>
---
 drivers/target/iscsi/iscsi_target_seq_pdu_list.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/target/iscsi/iscsi_target_seq_pdu_list.c b/drivers/target/iscsi/iscsi_target_seq_pdu_list.c
index 75c37c8866c86..2571097436399 100644
--- a/drivers/target/iscsi/iscsi_target_seq_pdu_list.c
+++ b/drivers/target/iscsi/iscsi_target_seq_pdu_list.c
@@ -549,6 +549,8 @@ int iscsit_build_pdu_and_seq_lists(
 		if (!pdu) {
 			pr_err("Unable to allocate struct iscsi_pdu list.\n");
 			kfree(seq);
+			cmd->seq_list = NULL;
+			cmd->seq_count = 0;
 			return -ENOMEM;
 		}
 		cmd->pdu_list = pdu;
-- 
2.51.0