[PATCH v2] nvmet: Free the old negotiation state when restarting authentication

[Keith Busch]

On Wed, Oct 28, 2026 at 04:55:51PM +0800, Guixin Liu wrote:
> Restarting a DH-HMAC-CHAP negotiation with SEND(NEGOTIATE) resets
> sq->dhchap_step but does not release the previous c1/c2/skey, which
> are only freed in nvmet_auth_sq_free() at teardown.  The next
> CHALLENGE/REPLY exchange then overwrites those pointers with fresh
> allocations.
> 
> An unauthenticated host can repeat the negotiate message endlessly,
> leaking a few dozen bytes per round and slowly exhausting target
> memory.
> 
> Clear the old negotiation state with nvmet_auth_sq_free() before
> setting up the new one.  Also reset dhchap_skey_len to zero: if a DH
> session key was already established, a following round with dhvlen=0
> would otherwise pass a NULL skey with a stale non-zero length to the
> HMAC code and dereference it.

Thanks, applied to nvme-7.4.