[PATCH] nvmet-auth: reject undersized AUTH_SEND payloads

[Keith Busch]

On Fri, Oct 09, 2026 at 03:38:10AM +0900, tjdqudcks0424 at naver.com wrote:
> From: Sung Byeongchan <tjdqudcks0424 at naver.com>
> 
> nvmet_execute_auth_send() allocates and copies the initiator-supplied
> transfer length, then reads auth_type and auth_id through a common DHCHAP
> message pointer.  The existing zero and transfer-length checks do not
> ensure that both common-header bytes are present.
> 
> An unauthenticated NVMe/TCP initiator can complete ICReq and admin CONNECT,
> then send AUTH_SEND with tl equal to one.  KASAN reports a one-byte slab
> out-of-bounds read when auth_id is loaded.

Thanks, applied to nvme-7.4.