Re: [PATCH] nvmet-auth: reject overlong negotiate identifier lists
Hannes Reinecke <[email protected]>
| Newsgroups | org.infradead.lists.linux-nvme,org.kernel.vger.linux-kernel,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
On 8/10/26 5:56 PM, Jérémy Jean wrote:
> The DH-HMAC-CHAP NEGOTIATE descriptor carries separate lengths for the
> hash and DH identifier lists, but each list occupies a fixed 30-byte half
> of idlist[]. nvmet_auth_negotiate() uses halen and dhlen from the wire as
> loop bounds without validating them, so a remote initiator can make the
> target read past the 72-byte request buffer. KASAN reports a
> slab-out-of-bounds read in nvmet_execute_auth_send().
>
> Reject list lengths above the protocol maxima before either loop
> indexes idlist[].
>
> Fixes: db1312dd9548 ("nvmet: implement basic In-Band Authentication")
> Cc: [email protected]
> Assisted-by: Codex:gpt-5
> Signed-off-by: Jérémy Jean <[email protected]>
> ---
> drivers/nvme/target/fabrics-cmd-auth.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/nvme/target/fabrics-cmd-auth.c b/drivers/nvme/target/fabrics-cmd-auth.c
> index 45820a12750d..8679d5db4f86 100644
> --- a/drivers/nvme/target/fabrics-cmd-auth.c
> +++ b/drivers/nvme/target/fabrics-cmd-auth.c
> @@ -71,6 +71,12 @@ static u8 nvmet_auth_negotiate(struct nvmet_req *req, void *d)
> NVME_AUTH_DHCHAP_AUTH_ID)
> return NVME_AUTH_DHCHAP_FAILURE_INCORRECT_PAYLOAD;
>
> + if (data->auth_protocol[0].dhchap.halen >
> + NVME_AUTH_DHCHAP_MAX_HASH_IDS ||
> + data->auth_protocol[0].dhchap.dhlen >
> + NVME_AUTH_DHCHAP_MAX_DH_IDS)
> + return NVME_AUTH_DHCHAP_FAILURE_INCORRECT_PAYLOAD;
> +
> for (i = 0; i < data->auth_protocol[0].dhchap.halen; i++) {
> u8 host_hmac_id = data->auth_protocol[0].dhchap.idlist[i];
>
Reviewed-by: Hannes Reinecke <[email protected]>
Cheers,
Hannes
--
Dr. Hannes Reinecke Kernel Storage Architect
[email protected] +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich