Re: [PATCH] nvmet: verify the hostid when looking up a controller

On 2026-08-22 22:56 UTC, Sagi Grimberg wrote:
> The hostid is not a secret either.
>
> I don't have a problem with the change, but I don't think that this
> should be positioned as a security fix, its more a correctness fix.

You are right. The hostid travels in the connect data and is just as
forgeable as the hostnqn, so this cannot stop a determined host from
claiming another host's identity; it only keeps the lookup consistent
with the identity a controller was created with.

I have posted a v2 that rewords the changelog as a correctness fix and
drops the security framing.

Yifei Chu