[PATCH v2] nvmet-auth: reject incomplete DHCHAP messages

[Hannes Reinecke]

On 11/2/26 2:24 PM, Jérémy Jean wrote:
> Commit c9359401036e ("nvmet-auth: reject undersized AUTH_SEND
> payloads") only ensures that AUTH_SEND has auth_type and auth_id
> before nvmet_execute_auth_send() starts parsing the payload, but the
> DHCHAP path reads t_id before it verifies message lengths. A two-byte
> DHCHAP NEGOTIATE payload can therefore still trigger an OOB read that
> KASAN reports as:
> 
>    BUG: KASAN: slab-out-of-bounds in nvmet_execute_auth_send
>    Read of size 2 at addr ffff8880030d8364
> 
> Require the payload to cover the minimum DHCHAP message length
> before parsing it.
> 
> Fixes: c9359401036e ("nvmet-auth: reject undersized AUTH_SEND payloads")
> Cc: stable at vger.kernel.org
> Signed-off-by: Jérémy Jean <Jeremy.Jean at oss.cyber.gouv.fr>
> ---
> 
> Changes in v2:
> - Check the minimum DHCHAP message length.
> 
> v1 (2026-08-11 18:03:35 +0000): https://lore.kernel.org/all/20260811180335.4161138-2-Jeremy.Jean@oss.cyber.gouv.fr/
> 
>   drivers/nvme/target/fabrics-cmd-auth.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/nvme/target/fabrics-cmd-auth.c b/drivers/nvme/target/fabrics-cmd-auth.c
> index 70136f6c22e8..a15f21fc41e4 100644
> --- a/drivers/nvme/target/fabrics-cmd-auth.c
> +++ b/drivers/nvme/target/fabrics-cmd-auth.c
> @@ -301,7 +301,7 @@ void nvmet_execute_auth_send(struct nvmet_req *req)
>   		nvmet_check_transfer_len(req, tl);
>   		return;
>   	}
> -	if (tl < offsetof(struct nvmf_auth_dhchap_success2_data, rsvd1)) {
> +	if (tl < sizeof(struct nvmf_auth_dhchap_failure_data)) {
>   		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
>   		req->error_loc =
>   			offsetof(struct nvmf_auth_send_command, tl);
> 

Reviewed-by: Hannes Reinecke <hare at kernel.org>

Cheers,

Hannes
-- 
Dr. Hannes Reinecke                  Kernel Storage Architect
hare at suse.de                                +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich