[PATCH] nvmet: synchronize DH-CHAP secret removal

[PATCH] nvmet: synchronize DH-CHAP secret removal

[Sreeraj S Kurup]

The empty-secret path in nvmet_auth_set_key() modifies and frees
host authentication secrets without holding nvmet_config_sem.

nvmet_setup_auth() accesses these fields under the read lock,
allowing concurrent secret removal to cause a use-after-free.

Acquire nvmet_config_sem for writing while clearing the secrets
to synchronize with authentication setup.

Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
---
 drivers/nvme/target/auth.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/nvme/target/auth.c b/drivers/nvme/target/auth.c
index ccba84b1344e..8fe521690ccd 100644
--- a/drivers/nvme/target/auth.c
+++ b/drivers/nvme/target/auth.c
@@ -26,6 +26,7 @@ int nvmet_auth_set_key(struct nvmet_host *host, const char *secret,
 	char *dhchap_secret;
 
 	if (!strlen(secret)) {
+		down_write(&nvmet_config_sem);
 		if (set_ctrl) {
 			kfree(host->dhchap_ctrl_secret);
 			host->dhchap_ctrl_secret = NULL;
@@ -35,6 +36,7 @@ int nvmet_auth_set_key(struct nvmet_host *host, const char *secret,
 			host->dhchap_secret = NULL;
 			host->dhchap_key_hash = 0;
 		}
+		up_write(&nvmet_config_sem);
 		return 0;
 	}
 	if (sscanf(secret, "DHHC-1:%hhd:%*s", &key_hash) != 1)
-- 
2.55.0

Re: [PATCH] nvmet: synchronize DH-CHAP secret removal

[Hannes Reinecke]

On 11/10/26 8:57 AM, Sreeraj S Kurup wrote:
> The empty-secret path in nvmet_auth_set_key() modifies and frees
> host authentication secrets without holding nvmet_config_sem.
> 
> nvmet_setup_auth() accesses these fields under the read lock,
> allowing concurrent secret removal to cause a use-after-free.
> 
> Acquire nvmet_config_sem for writing while clearing the secrets
> to synchronize with authentication setup.
> 
> Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
> ---
>   drivers/nvme/target/auth.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/nvme/target/auth.c b/drivers/nvme/target/auth.c
> index ccba84b1344e..8fe521690ccd 100644
> --- a/drivers/nvme/target/auth.c
> +++ b/drivers/nvme/target/auth.c
> @@ -26,6 +26,7 @@ int nvmet_auth_set_key(struct nvmet_host *host, const char *secret,
>   	char *dhchap_secret;
>   
>   	if (!strlen(secret)) {
> +		down_write(&nvmet_config_sem);
>   		if (set_ctrl) {
>   			kfree(host->dhchap_ctrl_secret);
>   			host->dhchap_ctrl_secret = NULL;
> @@ -35,6 +36,7 @@ int nvmet_auth_set_key(struct nvmet_host *host, const char *secret,
>   			host->dhchap_secret = NULL;
>   			host->dhchap_key_hash = 0;
>   		}
> +		up_write(&nvmet_config_sem);
>   		return 0;
>   	}
>   	if (sscanf(secret, "DHHC-1:%hhd:%*s", &key_hash) != 1)

Reviewed-by: Hannes Reinecke <hare@kernel.org>

Cheers,

Hannes
-- 
Dr. Hannes Reinecke                  Kernel Storage Architect
hare@suse.de                                +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich

Re: [PATCH] nvmet: synchronize DH-CHAP secret removal

[Sreeraj S Kurup]

Hi Hannes,

Thank you for reviewing the patch.

I've sent v2 with the missing Fixes: trailer added. 
The code changes are unchanged.

For reference, v2: https://lore.kernel.org/all/20261110081559.2730-1-sreekuttan2156239@gmail.com/

Thanks,
Sreeraj