* Re: [PATCH v2] nvmet-auth: reject incomplete DHCHAP messages
2026-11-02 13:24 [PATCH v2] nvmet-auth: reject incomplete DHCHAP messages Jérémy Jean
@ 2026-11-03 5:32 ` Christoph Hellwig
2026-11-03 7:35 ` Hannes Reinecke
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Christoph Hellwig @ 2026-11-03 5:32 UTC (permalink / raw)
To: Jérémy Jean
Cc: Hannes Reinecke, Christoph Hellwig, Sagi Grimberg,
Chaitanya Kulkarni, linux-nvme, linux-kernel, stable
Looks good:
Reviewed-by: Christoph Hellwig <hch@lst.de>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH v2] nvmet-auth: reject incomplete DHCHAP messages
2026-11-02 13:24 [PATCH v2] nvmet-auth: reject incomplete DHCHAP messages Jérémy Jean
2026-11-03 5:32 ` Christoph Hellwig
@ 2026-11-03 7:35 ` Hannes Reinecke
2026-11-03 15:36 ` Keith Busch
2026-11-10 12:49 ` Hannes Reinecke
3 siblings, 0 replies; 5+ messages in thread
From: Hannes Reinecke @ 2026-11-03 7:35 UTC (permalink / raw)
To: Jérémy Jean
Cc: Christoph Hellwig, Sagi Grimberg, Chaitanya Kulkarni, linux-nvme,
linux-kernel, stable
On 11/2/26 2:24 PM, Jérémy Jean wrote:
> Commit c9359401036e ("nvmet-auth: reject undersized AUTH_SEND
> payloads") only ensures that AUTH_SEND has auth_type and auth_id
> before nvmet_execute_auth_send() starts parsing the payload, but the
> DHCHAP path reads t_id before it verifies message lengths. A two-byte
> DHCHAP NEGOTIATE payload can therefore still trigger an OOB read that
> KASAN reports as:
>
> BUG: KASAN: slab-out-of-bounds in nvmet_execute_auth_send
> Read of size 2 at addr ffff8880030d8364
>
> Require the payload to cover the minimum DHCHAP message length
> before parsing it.
>
> Fixes: c9359401036e ("nvmet-auth: reject undersized AUTH_SEND payloads")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
> ---
>
> Changes in v2:
> - Check the minimum DHCHAP message length.
>
> v1 (2026-08-11 18:03:35 +0000): https://lore.kernel.org/all/20260811180335.4161138-2-Jeremy.Jean@oss.cyber.gouv.fr/
>
> drivers/nvme/target/fabrics-cmd-auth.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/nvme/target/fabrics-cmd-auth.c b/drivers/nvme/target/fabrics-cmd-auth.c
> index 70136f6c22e8..a15f21fc41e4 100644
> --- a/drivers/nvme/target/fabrics-cmd-auth.c
> +++ b/drivers/nvme/target/fabrics-cmd-auth.c
> @@ -301,7 +301,7 @@ void nvmet_execute_auth_send(struct nvmet_req *req)
> nvmet_check_transfer_len(req, tl);
> return;
> }
> - if (tl < offsetof(struct nvmf_auth_dhchap_success2_data, rsvd1)) {
> + if (tl < sizeof(struct nvmf_auth_dhchap_failure_data)) {
> status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
> req->error_loc =
> offsetof(struct nvmf_auth_send_command, tl);
>
Reviewed-by: Hannes Reinecke <hare@kernel.org>
Cheers,
Hannes
--
Dr. Hannes Reinecke Kernel Storage Architect
hare@suse.de +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH v2] nvmet-auth: reject incomplete DHCHAP messages
2026-11-02 13:24 [PATCH v2] nvmet-auth: reject incomplete DHCHAP messages Jérémy Jean
2026-11-03 5:32 ` Christoph Hellwig
2026-11-03 7:35 ` Hannes Reinecke
@ 2026-11-03 15:36 ` Keith Busch
2026-11-10 12:49 ` Hannes Reinecke
3 siblings, 0 replies; 5+ messages in thread
From: Keith Busch @ 2026-11-03 15:36 UTC (permalink / raw)
To: Jérémy Jean
Cc: Hannes Reinecke, Christoph Hellwig, Sagi Grimberg,
Chaitanya Kulkarni, linux-nvme, linux-kernel, stable
On Mon, Nov 02, 2026 at 01:24:19PM +0000, Jérémy Jean wrote:
> Commit c9359401036e ("nvmet-auth: reject undersized AUTH_SEND
> payloads") only ensures that AUTH_SEND has auth_type and auth_id
> before nvmet_execute_auth_send() starts parsing the payload, but the
> DHCHAP path reads t_id before it verifies message lengths. A two-byte
> DHCHAP NEGOTIATE payload can therefore still trigger an OOB read that
> KASAN reports as:
>
> BUG: KASAN: slab-out-of-bounds in nvmet_execute_auth_send
> Read of size 2 at addr ffff8880030d8364
>
> Require the payload to cover the minimum DHCHAP message length
> before parsing it.
Thanks, applied to nvme-7.4.
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH v2] nvmet-auth: reject incomplete DHCHAP messages
2026-11-02 13:24 [PATCH v2] nvmet-auth: reject incomplete DHCHAP messages Jérémy Jean
` (2 preceding siblings ...)
2026-11-03 15:36 ` Keith Busch
@ 2026-11-10 12:49 ` Hannes Reinecke
3 siblings, 0 replies; 5+ messages in thread
From: Hannes Reinecke @ 2026-11-10 12:49 UTC (permalink / raw)
To: Jérémy Jean
Cc: Christoph Hellwig, Sagi Grimberg, Chaitanya Kulkarni, linux-nvme,
linux-kernel, stable
On 11/2/26 2:24 PM, Jérémy Jean wrote:
> Commit c9359401036e ("nvmet-auth: reject undersized AUTH_SEND
> payloads") only ensures that AUTH_SEND has auth_type and auth_id
> before nvmet_execute_auth_send() starts parsing the payload, but the
> DHCHAP path reads t_id before it verifies message lengths. A two-byte
> DHCHAP NEGOTIATE payload can therefore still trigger an OOB read that
> KASAN reports as:
>
> BUG: KASAN: slab-out-of-bounds in nvmet_execute_auth_send
> Read of size 2 at addr ffff8880030d8364
>
> Require the payload to cover the minimum DHCHAP message length
> before parsing it.
>
> Fixes: c9359401036e ("nvmet-auth: reject undersized AUTH_SEND payloads")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
> ---
>
> Changes in v2:
> - Check the minimum DHCHAP message length.
>
> v1 (2026-08-11 18:03:35 +0000): https://lore.kernel.org/all/20260811180335.4161138-2-Jeremy.Jean@oss.cyber.gouv.fr/
>
> drivers/nvme/target/fabrics-cmd-auth.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/nvme/target/fabrics-cmd-auth.c b/drivers/nvme/target/fabrics-cmd-auth.c
> index 70136f6c22e8..a15f21fc41e4 100644
> --- a/drivers/nvme/target/fabrics-cmd-auth.c
> +++ b/drivers/nvme/target/fabrics-cmd-auth.c
> @@ -301,7 +301,7 @@ void nvmet_execute_auth_send(struct nvmet_req *req)
> nvmet_check_transfer_len(req, tl);
> return;
> }
> - if (tl < offsetof(struct nvmf_auth_dhchap_success2_data, rsvd1)) {
> + if (tl < sizeof(struct nvmf_auth_dhchap_failure_data)) {
> status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
> req->error_loc =
> offsetof(struct nvmf_auth_send_command, tl);
>
Reviewed=by: Hannes Reinecke <hare@kernel.org>
Cheers,
Hannes
--
Dr. Hannes Reinecke Kernel Storage Architect
hare@suse.de +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich
^ permalink raw reply [flat|nested] 5+ messages in thread