[PATCH] nvmet-auth: fix error handling on CHALLENGE failure

[Keith Busch]

On Mon, Oct 26, 2026 at 04:45:26PM +0800, shao.mingyin at zte.com.cn wrote:
> From: Shao Mingyin <shao.mingyin at zte.com.cn>
> 
> In nvmet_execute_auth_receive(), when nvmet_auth_challenge() fails (for
> example when the initiator-supplied allocation length is shorter than the
> DH-HMAC-CHAP challenge response, or the challenge nonce allocation fails),
> the error path sets status = NVME_SC_INTERNAL and breaks out of the
> switch. The unconditional
> 
>     status = nvmet_copy_to_sgl(req, 0, d, al);
> 
> after the switch then overwrites the error status (nvmet_copy_to_sgl()
> returns 0 on success), so the AUTH_RECEIVE command incorrectly completes
> with SUCCESS and the initiator proceeds with a truncated/empty challenge.
> 
> Fix this by freeing the buffer and jumping to the common done: label on
> CHALLENGE failure, skipping the copy_to_sgl() entirely and preserving the
> NVME_SC_INTERNAL status.

Thanks, applied to nvme-7.4.