Re: [PATCH] nvmet: synchronize DH-CHAP secret removal

[Hannes Reinecke <hare@suse.de>]

On 11/10/26 8:57 AM, Sreeraj S Kurup wrote:
> The empty-secret path in nvmet_auth_set_key() modifies and frees
> host authentication secrets without holding nvmet_config_sem.
> 
> nvmet_setup_auth() accesses these fields under the read lock,
> allowing concurrent secret removal to cause a use-after-free.
> 
> Acquire nvmet_config_sem for writing while clearing the secrets
> to synchronize with authentication setup.
> 
> Signed-off-by: Sreeraj S Kurup <sreekuttan2156239@gmail.com>
> ---
>   drivers/nvme/target/auth.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/nvme/target/auth.c b/drivers/nvme/target/auth.c
> index ccba84b1344e..8fe521690ccd 100644
> --- a/drivers/nvme/target/auth.c
> +++ b/drivers/nvme/target/auth.c
> @@ -26,6 +26,7 @@ int nvmet_auth_set_key(struct nvmet_host *host, const char *secret,
>   	char *dhchap_secret;
>   
>   	if (!strlen(secret)) {
> +		down_write(&nvmet_config_sem);
>   		if (set_ctrl) {
>   			kfree(host->dhchap_ctrl_secret);
>   			host->dhchap_ctrl_secret = NULL;
> @@ -35,6 +36,7 @@ int nvmet_auth_set_key(struct nvmet_host *host, const char *secret,
>   			host->dhchap_secret = NULL;
>   			host->dhchap_key_hash = 0;
>   		}
> +		up_write(&nvmet_config_sem);
>   		return 0;
>   	}
>   	if (sscanf(secret, "DHHC-1:%hhd:%*s", &key_hash) != 1)

Reviewed-by: Hannes Reinecke <hare@kernel.org>

Cheers,

Hannes
-- 
Dr. Hannes Reinecke                  Kernel Storage Architect
hare@suse.de                                +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich