[PATCH v2] nvmet-auth: reject incomplete DHCHAP messages

[Keith Busch]

On Mon, Nov 02, 2026 at 01:24:19PM +0000, Jérémy Jean wrote:
> Commit c9359401036e ("nvmet-auth: reject undersized AUTH_SEND
> payloads") only ensures that AUTH_SEND has auth_type and auth_id
> before nvmet_execute_auth_send() starts parsing the payload, but the
> DHCHAP path reads t_id before it verifies message lengths. A two-byte
> DHCHAP NEGOTIATE payload can therefore still trigger an OOB read that
> KASAN reports as:
> 
>   BUG: KASAN: slab-out-of-bounds in nvmet_execute_auth_send
>   Read of size 2 at addr ffff8880030d8364
> 
> Require the payload to cover the minimum DHCHAP message length
> before parsing it.

Thanks, applied to nvme-7.4.