[PATCH 3/6] nvme-auth: fix data race on ctrl->transaction

[Hannes Reinecke]

On 11/6/26 2:58 AM, Guixin Liu wrote:
> nvme_ctrl_auth_work() queues the DH-HMAC-CHAP exchange of every queue
> on nvme-auth-wq without waiting for them, so multiple
> nvme_queue_auth_work() instances run concurrently and all increment
> ctrl->transaction in nvme_queue_auth_work(). The plain increment is a
> data race, and the lost updates hand the same transaction id to
> concurrent queues.
> 
> The controller side only echoes the transaction id within a queue, so
> the race has no functional impact today, but the increment is still
> unsynchronized and KCSAN reports it. Use an atomic_t.
> 
> Signed-off-by: Guixin Liu <kanie at linux.alibaba.com>
> ---
>   drivers/nvme/host/auth.c | 2 +-
>   drivers/nvme/host/nvme.h | 2 +-
>   2 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
> index 85f005a5efd0..107355ee9ef1 100644
> --- a/drivers/nvme/host/auth.c
> +++ b/drivers/nvme/host/auth.c
> @@ -765,7 +765,7 @@ static void nvme_queue_auth_work(struct work_struct *work)
>   		return;
>   	}
>   
> -	chap->transaction = ctrl->transaction++;
> +	chap->transaction = (u16)atomic_fetch_inc(&ctrl->transaction);
>   
>   	/* DH-HMAC-CHAP Step 1: send negotiate */
>   	dev_dbg(ctrl->device, "%s: qid %d send negotiate\n",
> diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
> index 92c048002ecd..1fb676dade12 100644
> --- a/drivers/nvme/host/nvme.h
> +++ b/drivers/nvme/host/nvme.h
> @@ -446,7 +446,7 @@ struct nvme_ctrl {
>   	struct nvme_dhchap_queue_context *dhchap_ctxs;
>   	struct nvme_dhchap_key *host_key;
>   	struct nvme_dhchap_key *ctrl_key;
> -	u16 transaction;
> +	atomic_t transaction;
>   #endif
>   	key_serial_t tls_pskid;
>   
Hi-speed authentication races ... every day a new surprise.
Although I wonder why a normal 'atomic_inc_return' isn't sufficient.

Reviewed-by: Hannes Reinecke <hare at kernel.org>

Cheers,

Hannes
-- 
Dr. Hannes Reinecke                  Kernel Storage Architect
hare at suse.de                                +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich