[PATCH] nvmet-auth: reject overlong negotiate identifier lists

[Hannes Reinecke]

On 8/10/26 5:56 PM, Jérémy Jean wrote:
> The DH-HMAC-CHAP NEGOTIATE descriptor carries separate lengths for the
> hash and DH identifier lists, but each list occupies a fixed 30-byte half
> of idlist[]. nvmet_auth_negotiate() uses halen and dhlen from the wire as
> loop bounds without validating them, so a remote initiator can make the
> target read past the 72-byte request buffer. KASAN reports a
> slab-out-of-bounds read in nvmet_execute_auth_send().
> 
> Reject list lengths above the protocol maxima before either loop
> indexes idlist[].
> 
> Fixes: db1312dd9548 ("nvmet: implement basic In-Band Authentication")
> Cc: stable at vger.kernel.org
> Assisted-by: Codex:gpt-5
> Signed-off-by: Jérémy Jean <Jeremy.Jean at oss.cyber.gouv.fr>
> ---
>   drivers/nvme/target/fabrics-cmd-auth.c | 6 ++++++
>   1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/nvme/target/fabrics-cmd-auth.c b/drivers/nvme/target/fabrics-cmd-auth.c
> index 45820a12750d..8679d5db4f86 100644
> --- a/drivers/nvme/target/fabrics-cmd-auth.c
> +++ b/drivers/nvme/target/fabrics-cmd-auth.c
> @@ -71,6 +71,12 @@ static u8 nvmet_auth_negotiate(struct nvmet_req *req, void *d)
>   	    NVME_AUTH_DHCHAP_AUTH_ID)
>   		return NVME_AUTH_DHCHAP_FAILURE_INCORRECT_PAYLOAD;
>   
> +	if (data->auth_protocol[0].dhchap.halen >
> +	    NVME_AUTH_DHCHAP_MAX_HASH_IDS ||
> +	    data->auth_protocol[0].dhchap.dhlen >
> +	    NVME_AUTH_DHCHAP_MAX_DH_IDS)
> +		return NVME_AUTH_DHCHAP_FAILURE_INCORRECT_PAYLOAD;
> +
>   	for (i = 0; i < data->auth_protocol[0].dhchap.halen; i++) {
>   		u8 host_hmac_id = data->auth_protocol[0].dhchap.idlist[i];
>   

Reviewed-by: Hannes Reinecke <hare at suse.de>

Cheers,

Hannes
-- 
Dr. Hannes Reinecke                  Kernel Storage Architect
hare at suse.de                                +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich