Re: [PATCH 0/2] scsi: target: fix CHAP_N handling

On Tue, 2 Jun 2026 17:42:57 +0100, John Garry wrote:

> On 02/06/2026 12:43, David Disseldorp wrote:
> > The sashiko bot pointed out issues with CHAP_N handling recently, when
> > reviewing a patch for a separate issue:
> > https://urldefense.com/v3/__https://sashiko.dev/*/patchset/20260521151121.808477-1-hossu.alexandru*40gmail.com__;IyU!!ACWV5N9M2RV99hQ!MNesZJ3IsH9Mv0iZxHUcVmbC_3uwDkJgMhAX8i1TelyqqZD_dAq1cwIy6RtYI8D3boJh5iFeGhtTvfTX$
> >    Since extract_param() unconditionally strips '0x' or '0b' prefixes and
> >    alters the returned type, wouldn't a valid user with a name like '0xalice' or
> >    '0bob' have their username mutated to 'alice' or 'ob'?  
> 
> is there a real world case or vulnerability being fixed here?

No vulnerability -  the "real world case" is as above: CHAP
authentication currently fails if the CHAP username begins with 0x, 0b
or the upper case variants. The bug is trivial to reproduce.

Thanks, David