[PATCH v2] nvmet: verify the hostid when looking up a controller

[Sagi Grimberg]

On 27/08/2026 13:12, Yifei Chu wrote:
> nvmet_ctrl_find_get() matches controllers by cntlid and hostnqn only.
> The connect data also carries the connecting host's hostid, but it is
> never compared against the hostid the controller was created with, so
> the lookup can return a controller whose recorded hostid differs.
>
> Controller IDs are allocated sequentially and easy to guess, and
> nothing prevents two hosts from using the same hostnqn (misconfigured
> clones, or a reinstalled host whose controller still exists). Such a
> host currently attaches its queues to the other host's controller and
> shares its controller state with it. Also

This paragraph is pretty useless IMO. I think you can drop it.

> require the hostid from the
> connect data to match the controller's hostid so that the lookup is
> bound to the identity the controller was created with.

Keep this.

Other than that,
Reviewed-by: Sagi Grimberg <sagi at grimberg.me>