[PATCH] nvmet: require authentication before property set

[Keith Busch]

On Wed, Oct 07, 2026 at 03:30:41PM +0900, Sung Byeongchan wrote:
> I/O queues do not perform independent DH-HMAC-CHAP authentication.  They
> instead rely on authentication of the controller's admin queue.  Fabrics
> property commands, however, are dispatched before the general admin command
> authentication check.
> 
> An unauthenticated peer can consequently set CC.EN, connect an I/O queue,
> and access a namespace after admin CONNECT reported that authentication was
> required.  Reject PROPERTY_SET until the admin queue has authenticated.
> Targets without a configured authentication key are unchanged.
> 
> This was found by source review with AI assistance.  A localhost NVMe/TCP
> wire reproducer retrieved a known 4 KiB namespace block in two independent
> boots without completing AUTH_SEND or AUTH_RECEIVE.  With this change,
> PROPERTY_SET returned NVME_SC_AUTH_REQUIRED and the namespace data was not
> returned; the no-authentication control continued to work.

Thanks, applied to nvme-7.4.