[PATCH] nvmet-auth: serialize access to DH-HMAC-CHAP state to fix UAF

[Keith Busch]

On Sat, Oct 03, 2026 at 09:01:55PM +0000, Jérémy Jean wrote:
> A REPLY AUTH_SEND command can derive a dhchap_skey key while a
> concurrent AUTH_RECEIVE command observing this REPLY state executes
> the failure path and frees that key. The REPLY command then continues
> and writes into freed memory, causing a use-after-free. KASAN reports
> it as:
> 
>   BUG: KASAN: slab-use-after-free in __sha256_final
>   Write of size 4 at addr ffff88800359c540
>   ...
>   nvmet_auth_sq_free (drivers/nvme/target/auth.c:237)
>   nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:621)
> 
> Add a mutex to each submission queue to serialize authentication
> commands and timeout handling. Unlock the mutex before completing
> requests and ignore outdated timeout callbacks. Limit timeout delays
> to prevent immediate expiry on 32-bit kernels.

Thanks, applied to nvme-7.4.