[PATCH] nvmet-auth: fix error handling on CHALLENGE failure

[PATCH] nvmet-auth: fix error handling on CHALLENGE failure

[shao.mingyin]

From: Shao Mingyin <shao.mingyin@zte.com.cn>

In nvmet_execute_auth_receive(), when nvmet_auth_challenge() fails (for
example when the initiator-supplied allocation length is shorter than the
DH-HMAC-CHAP challenge response, or the challenge nonce allocation fails),
the error path sets status = NVME_SC_INTERNAL and breaks out of the
switch. The unconditional

    status = nvmet_copy_to_sgl(req, 0, d, al);

after the switch then overwrites the error status (nvmet_copy_to_sgl()
returns 0 on success), so the AUTH_RECEIVE command incorrectly completes
with SUCCESS and the initiator proceeds with a truncated/empty challenge.

Fix this by freeing the buffer and jumping to the common done: label on
CHALLENGE failure, skipping the copy_to_sgl() entirely and preserving the
NVME_SC_INTERNAL status.

Fixes: db1312dd9548 ("nvmet: implement basic In-Band Authentication")
Cc: stable@vger.kernel.org
Signed-off-by: Shao Mingyin <shao.mingyin@zte.com.cn>

---
diff --git a/drivers/nvme/target/fabrics-cmd-auth.c b/drivers/nvme/target/fabrics-cmd-auth.c
index 1fe21f2672f1..bd1185f13ab2 100644
--- a/drivers/nvme/target/fabrics-cmd-auth.c
+++ b/drivers/nvme/target/fabrics-cmd-auth.c
@@ -605,10 +605,11 @@ void nvmet_execute_auth_receive(struct nvmet_req *req)
 	switch (req->sq->dhchap_step) {
 	case NVME_AUTH_DHCHAP_MESSAGE_CHALLENGE:
 		if (nvmet_auth_challenge(req, d, al) < 0) {
-			pr_warn("ctrl %d qid %d: challenge error (%d)\n",
-				ctrl->cntlid, req->sq->qid, status);
+			pr_warn("ctrl %d qid %d: challenge error\n",
+				ctrl->cntlid, req->sq->qid);
 			status = NVME_SC_INTERNAL;
-			break;
+			kfree(d);
+			goto done;
 		}
 		req->sq->dhchap_step = NVME_AUTH_DHCHAP_MESSAGE_REPLY;
 		break;

Re: [PATCH] nvmet-auth: fix error handling on CHALLENGE failure

[Keith Busch]

On Mon, Oct 26, 2026 at 04:45:26PM +0800, shao.mingyin@zte.com.cn wrote:
> From: Shao Mingyin <shao.mingyin@zte.com.cn>
> 
> In nvmet_execute_auth_receive(), when nvmet_auth_challenge() fails (for
> example when the initiator-supplied allocation length is shorter than the
> DH-HMAC-CHAP challenge response, or the challenge nonce allocation fails),
> the error path sets status = NVME_SC_INTERNAL and breaks out of the
> switch. The unconditional
> 
>     status = nvmet_copy_to_sgl(req, 0, d, al);
> 
> after the switch then overwrites the error status (nvmet_copy_to_sgl()
> returns 0 on success), so the AUTH_RECEIVE command incorrectly completes
> with SUCCESS and the initiator proceeds with a truncated/empty challenge.
> 
> Fix this by freeing the buffer and jumping to the common done: label on
> CHALLENGE failure, skipping the copy_to_sgl() entirely and preserving the
> NVME_SC_INTERNAL status.

Thanks, applied to nvme-7.4.