[PATCH] nvmet: require authentication before property set

[PATCH] nvmet: require authentication before property set

[Sung Byeongchan]

I/O queues do not perform independent DH-HMAC-CHAP authentication.  They
instead rely on authentication of the controller's admin queue.  Fabrics
property commands, however, are dispatched before the general admin command
authentication check.

An unauthenticated peer can consequently set CC.EN, connect an I/O queue,
and access a namespace after admin CONNECT reported that authentication was
required.  Reject PROPERTY_SET until the admin queue has authenticated.
Targets without a configured authentication key are unchanged.

This was found by source review with AI assistance.  A localhost NVMe/TCP
wire reproducer retrieved a known 4 KiB namespace block in two independent
boots without completing AUTH_SEND or AUTH_RECEIVE.  With this change,
PROPERTY_SET returned NVME_SC_AUTH_REQUIRED and the namespace data was not
returned; the no-authentication control continued to work.

Fixes: c91a20129185 ("nvmet-auth: authenticate on admin queue only")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Sung Byeongchan <tjdqudcks0424@naver.com>
---
 drivers/nvme/target/fabrics-cmd.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/nvme/target/fabrics-cmd.c b/drivers/nvme/target/fabrics-cmd.c
index 42d1d18116715..b451029ab8f49 100644
--- a/drivers/nvme/target/fabrics-cmd.c
+++ b/drivers/nvme/target/fabrics-cmd.c
@@ -14,6 +14,10 @@ static void nvmet_execute_prop_set(struct nvmet_req *req)
 
 	if (!nvmet_check_transfer_len(req, 0))
 		return;
+	if (!nvmet_check_auth_status(req)) {
+		status = NVME_SC_AUTH_REQUIRED | NVME_STATUS_DNR;
+		goto out;
+	}
 
 	if (req->cmd->prop_set.attrib & 1) {
 		req->error_loc =
-- 
2.43.0

Re: [PATCH] nvmet: require authentication before property set

[Christoph Hellwig]

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>

Re: [PATCH] nvmet: require authentication before property set

[Keith Busch]

On Wed, Oct 07, 2026 at 03:30:41PM +0900, Sung Byeongchan wrote:
> I/O queues do not perform independent DH-HMAC-CHAP authentication.  They
> instead rely on authentication of the controller's admin queue.  Fabrics
> property commands, however, are dispatched before the general admin command
> authentication check.
> 
> An unauthenticated peer can consequently set CC.EN, connect an I/O queue,
> and access a namespace after admin CONNECT reported that authentication was
> required.  Reject PROPERTY_SET until the admin queue has authenticated.
> Targets without a configured authentication key are unchanged.
> 
> This was found by source review with AI assistance.  A localhost NVMe/TCP
> wire reproducer retrieved a known 4 KiB namespace block in two independent
> boots without completing AUTH_SEND or AUTH_RECEIVE.  With this change,
> PROPERTY_SET returned NVME_SC_AUTH_REQUIRED and the namespace data was not
> returned; the no-authentication control continued to work.

Thanks, applied to nvme-7.4.