[PATCH] nvmet-auth: reject undersized AUTH_SEND payloads

[PATCH] nvmet-auth: reject undersized AUTH_SEND payloads

[tjdqudcks0424]

From: Sung Byeongchan <tjdqudcks0424@naver.com>

nvmet_execute_auth_send() allocates and copies the initiator-supplied
transfer length, then reads auth_type and auth_id through a common DHCHAP
message pointer.  The existing zero and transfer-length checks do not
ensure that both common-header bytes are present.

An unauthenticated NVMe/TCP initiator can complete ICReq and admin CONNECT,
then send AUTH_SEND with tl equal to one.  KASAN reports a one-byte slab
out-of-bounds read when auth_id is loaded.

Reject payloads that do not cover the common auth_type/auth_id header
before allocating or parsing them.  The one-byte trigger and
header-minus-one boundary were cleanly rejected in three fixed fresh-boot
runs.  Exact-header, valid DHCHAP, wrong-type, mismatch, and zero-length
controls remained clean, and a following valid AUTH_SEND on the same
connection received a response.  The touched source is unchanged at
0c2669a9f4a1d607e7591ae50ccf3c432a0aff08, where the patch applies and
builds cleanly.

The demonstrated impact is unauthenticated pre-authentication target-kernel
denial of service.  No disclosure, controlled write, RCE, or LPE was
demonstrated.  The source reproducer and complete logs are available on
request and are not included in this public report.

OpenAI Codex assisted source inspection, test design, patch drafting, and
evidence organization.

Fixes: db1312dd9548 ("nvmet: implement basic In-Band Authentication")
Assisted-by: LLM
Signed-off-by: Sung Byeongchan <tjdqudcks0424@naver.com>
---
 drivers/nvme/target/fabrics-cmd-auth.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/nvme/target/fabrics-cmd-auth.c b/drivers/nvme/target/fabrics-cmd-auth.c
index dccdb55a367c5..1cdebd580722a 100644
--- a/drivers/nvme/target/fabrics-cmd-auth.c
+++ b/drivers/nvme/target/fabrics-cmd-auth.c
@@ -285,6 +285,12 @@ void nvmet_execute_auth_send(struct nvmet_req *req)
 		pr_debug("%s: transfer length mismatch (%u)\n", __func__, tl);
 		return;
 	}
+	if (tl < offsetof(struct nvmf_auth_dhchap_success2_data, rsvd1)) {
+		status = NVME_SC_INVALID_FIELD | NVME_STATUS_DNR;
+		req->error_loc =
+			offsetof(struct nvmf_auth_send_command, tl);
+		goto done;
+	}
 
 	d = kmalloc(tl, GFP_KERNEL);
 	if (!d) {
-- 
2.43.0

Re: [PATCH] nvmet-auth: reject undersized AUTH_SEND payloads

[Christoph Hellwig]

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>

Re: [PATCH] nvmet-auth: reject undersized AUTH_SEND payloads

[Keith Busch]

On Fri, Oct 09, 2026 at 03:38:10AM +0900, tjdqudcks0424@naver.com wrote:
> From: Sung Byeongchan <tjdqudcks0424@naver.com>
> 
> nvmet_execute_auth_send() allocates and copies the initiator-supplied
> transfer length, then reads auth_type and auth_id through a common DHCHAP
> message pointer.  The existing zero and transfer-length checks do not
> ensure that both common-header bytes are present.
> 
> An unauthenticated NVMe/TCP initiator can complete ICReq and admin CONNECT,
> then send AUTH_SEND with tl equal to one.  KASAN reports a one-byte slab
> out-of-bounds read when auth_id is loaded.

Thanks, applied to nvme-7.4.