[PATCH] nvmet: verify the hostid when looking up a controller

[Christoph Hellwig]

On Tue, Aug 18, 2026 at 06:25:51PM +0200, Chuyf26 wrote:
> nvmet_ctrl_find_get() matches controllers by cntlid and hostnqn only.
> The hostnqn is not a secret: any host that can reach the subsystem can
> put an arbitrary NQN into its connect data.  A malicious host knowing
> or guessing the NQN and controller ID of another host (controller IDs
> are allocated sequentially) can therefore attach its queues to that
> host's controller, issue commands on its behalf, or disturb its I/O by
> tearing down the shared controller state.

Yes.

> Also require the hostid from the connect data to match the controller's
> hostid.  The hostid identifies the host installation and is generated
> locally, so it cannot be chosen by an attacker to impersonate another
> host.  Controllers that were created without a hostid keep the old
> behaviour.

Of course it can.  Please don't send completely useless LLM garbage,
thank you!