[PATCH] nvmet-auth: reject overlong negotiate identifier lists

[Jérémy Jean]

The DH-HMAC-CHAP NEGOTIATE descriptor carries separate lengths for the
hash and DH identifier lists, but each list occupies a fixed 30-byte half
of idlist[]. nvmet_auth_negotiate() uses halen and dhlen from the wire as
loop bounds without validating them, so a remote initiator can make the
target read past the 72-byte request buffer. KASAN reports a 
slab-out-of-bounds read in nvmet_execute_auth_send().

Reject list lengths above the protocol maxima before either loop
indexes idlist[].

Fixes: db1312dd9548 ("nvmet: implement basic In-Band Authentication")
Cc: stable at vger.kernel.org
Assisted-by: Codex:gpt-5
Signed-off-by: Jérémy Jean <Jeremy.Jean at oss.cyber.gouv.fr>
---
 drivers/nvme/target/fabrics-cmd-auth.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/nvme/target/fabrics-cmd-auth.c b/drivers/nvme/target/fabrics-cmd-auth.c
index 45820a12750d..8679d5db4f86 100644
--- a/drivers/nvme/target/fabrics-cmd-auth.c
+++ b/drivers/nvme/target/fabrics-cmd-auth.c
@@ -71,6 +71,12 @@ static u8 nvmet_auth_negotiate(struct nvmet_req *req, void *d)
 	    NVME_AUTH_DHCHAP_AUTH_ID)
 		return NVME_AUTH_DHCHAP_FAILURE_INCORRECT_PAYLOAD;
 
+	if (data->auth_protocol[0].dhchap.halen >
+	    NVME_AUTH_DHCHAP_MAX_HASH_IDS ||
+	    data->auth_protocol[0].dhchap.dhlen >
+	    NVME_AUTH_DHCHAP_MAX_DH_IDS)
+		return NVME_AUTH_DHCHAP_FAILURE_INCORRECT_PAYLOAD;
+
 	for (i = 0; i < data->auth_protocol[0].dhchap.halen; i++) {
 		u8 host_hmac_id = data->auth_protocol[0].dhchap.idlist[i];
 
-- 
2.47.3