[PATCH 0/2] nvme: use the parsed offset for DH-CHAP secrets

[shao.mingyin at zte.com.cn]

Both the host and the target parse a DH-HMAC-CHAP secret with
sscanf("DHHC-1:%hhd:...") and then skip a hardcoded ten characters to
reach the key.  The prefix is only nine characters when the hash
identifier is one digit, so a short but accepted secret makes the key
pointer point past the end of the string and the follow-up strlen() read
past the allocation.

Patch 1 changes the host-side parser to record the offset of the key with
%n and use it instead of the constant.

Patch 2 makes the same change on the target side and stores the offset
with each configured secret, so nvmet_setup_auth() no longer adds the
constant to the stored string.

The two patches touch different trees (common/host and target) and are
independent.  Both carry Fixes: and Cc: stable.

Testing: both apply to next-20261105 (`ddfe51b0a0f5`), pass checkpatch.pl
--strict with 0 errors/0 warnings/0 checks, and the affected files build
under W=1.

Both were also reproduced on a KASAN kernel (7.3.0-next-20261030,
CONFIG_NVME_HOST_AUTH/TARGET_AUTH): a 9-byte "DHHC-1:1:" secret written
through the host sysfs attribute, and a target host entry configured with
the same key, both made nvme_auth_extract_key() read one byte past the
10-byte allocation (KASAN slab-out-of-bounds in strlen/strrchr). With the
two patches the same boots produce no KASAN report.

Shao Mingyin (2):
  nvme-auth: use the parsed offset for the DH-CHAP key
  nvmet-auth: store the DH-CHAP key offset instead of hardcoding it

 drivers/nvme/common/auth.c  |  6 ++++--
 drivers/nvme/target/auth.c  | 17 ++++++++++++-----
 drivers/nvme/target/nvmet.h |  2 ++
 3 files changed, 18 insertions(+), 7 deletions(-)

---
base-commit: ddfe51b0a0f5dc9e415cc2c8ad8db17532dd426b