Re: [PATCH] nvmet: verify the hostid when looking up a controller

On 18/08/2026 19:26, Chuyf26 wrote:
> nvmet_ctrl_find_get() matches controllers by cntlid and hostnqn only.
> The hostnqn is not a secret: any host that can reach the subsystem can
> put an arbitrary NQN into its connect data.  A malicious host knowing
> or guessing the NQN and controller ID of another host (controller IDs
> are allocated sequentially) can therefore attach its queues to that
> host's controller, issue commands on its behalf, or disturb its I/O by
> tearing down the shared controller state.

The hostid is not a secret either.

>
> The path is: an unauthenticated host sends a fabrics CONNECT command,
> nvmet_execute_fabrics_connect() parses the connect data capsule and
> hands subsysnqn, hostnqn and cntlid to nvmet_ctrl_find_get(), which
> returns the first matching controller.  The connect data also carries
> the host's hostid, but it is never compared.
>
> Also require the hostid from the connect data to match the controller's
> hostid.  The hostid identifies the host installation and is generated
> locally, so it cannot be chosen by an attacker to impersonate another
> host.  Controllers that were created without a hostid keep the old
> behaviour.

I don't have a problem with the change, but I don't think that this
should be positioned as a security fix, its more a correctness fix. So I 
would
suggest to change the commit msg body.