[PATCH 3/6] nvme-auth: fix data race on ctrl->transaction

[Guixin Liu]

在 2026/11/6 15:27, Hannes Reinecke 写道:
> On 11/6/26 2:58 AM, Guixin Liu wrote:
>> nvme_ctrl_auth_work() queues the DH-HMAC-CHAP exchange of every queue
>> on nvme-auth-wq without waiting for them, so multiple
>> nvme_queue_auth_work() instances run concurrently and all increment
>> ctrl->transaction in nvme_queue_auth_work(). The plain increment is a
>> data race, and the lost updates hand the same transaction id to
>> concurrent queues.
>>
>> The controller side only echoes the transaction id within a queue, so
>> the race has no functional impact today, but the increment is still
>> unsynchronized and KCSAN reports it. Use an atomic_t.
>>
>> Signed-off-by: Guixin Liu <kanie at linux.alibaba.com>
>> ---
>>   drivers/nvme/host/auth.c | 2 +-
>>   drivers/nvme/host/nvme.h | 2 +-
>>   2 files changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/nvme/host/auth.c b/drivers/nvme/host/auth.c
>> index 85f005a5efd0..107355ee9ef1 100644
>> --- a/drivers/nvme/host/auth.c
>> +++ b/drivers/nvme/host/auth.c
>> @@ -765,7 +765,7 @@ static void nvme_queue_auth_work(struct work_struct *work)
>>           return;
>>       }
>>   -    chap->transaction = ctrl->transaction++;
>> +    chap->transaction = (u16)atomic_fetch_inc(&ctrl->transaction);
>>         /* DH-HMAC-CHAP Step 1: send negotiate */
>>       dev_dbg(ctrl->device, "%s: qid %d send negotiate\n",
>> diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
>> index 92c048002ecd..1fb676dade12 100644
>> --- a/drivers/nvme/host/nvme.h
>> +++ b/drivers/nvme/host/nvme.h
>> @@ -446,7 +446,7 @@ struct nvme_ctrl {
>>       struct nvme_dhchap_queue_context *dhchap_ctxs;
>>       struct nvme_dhchap_key *host_key;
>>       struct nvme_dhchap_key *ctrl_key;
>> -    u16 transaction;
>> +    atomic_t transaction;
>>   #endif
>>       key_serial_t tls_pskid;
>>   
> Hi-speed authentication races ... every day a new surprise.
> Although I wonder why a normal 'atomic_inc_return' isn't sufficient.
Sure, changed in v2.

Best Regards,
Guixin Liu
>
> Reviewed-by: Hannes Reinecke <hare at kernel.org>
>
> Cheers,
>
> Hannes