[PATCH v2] nvmet: Free the old negotiation state when restarting authentication

[PATCH v2] nvmet: Free the old negotiation state when restarting authentication

[Guixin Liu]

Restarting a DH-HMAC-CHAP negotiation with SEND(NEGOTIATE) resets
sq->dhchap_step but does not release the previous c1/c2/skey, which
are only freed in nvmet_auth_sq_free() at teardown.  The next
CHALLENGE/REPLY exchange then overwrites those pointers with fresh
allocations.

An unauthenticated host can repeat the negotiate message endlessly,
leaking a few dozen bytes per round and slowly exhausting target
memory.

Clear the old negotiation state with nvmet_auth_sq_free() before
setting up the new one.  Also reset dhchap_skey_len to zero: if a DH
session key was already established, a following round with dhvlen=0
would otherwise pass a NULL skey with a stale non-zero length to the
HMAC code and dereference it.

Fixes: db1312dd95488 ("nvmet: implement basic In-Band Authentication")
Cc: stable@vger.kernel.org
Signed-off-by: Guixin Liu <kanie@linux.alibaba.com>
---

Changes since v1:
- Also reset dhchap_skey_len when clearing the old negotiation state,
  so a following round with dhvlen=0 cannot pass a NULL skey with a
  stale non-zero length to the HMAC code (Sashiko AI review)
 drivers/nvme/target/auth.c             | 1 +
 drivers/nvme/target/fabrics-cmd-auth.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/drivers/nvme/target/auth.c b/drivers/nvme/target/auth.c
index 1680e5e6839c..574025730834 100644
--- a/drivers/nvme/target/auth.c
+++ b/drivers/nvme/target/auth.c
@@ -237,6 +237,7 @@ void nvmet_auth_sq_free(struct nvmet_sq *sq)
 	sq->dhchap_c2 = NULL;
 	kfree(sq->dhchap_skey);
 	sq->dhchap_skey = NULL;
+	sq->dhchap_skey_len = 0;
 }
 
 void nvmet_auth_sq_destroy(struct nvmet_sq *sq)
diff --git a/drivers/nvme/target/fabrics-cmd-auth.c b/drivers/nvme/target/fabrics-cmd-auth.c
index bc49b48cdd63..3d9840d37a8b 100644
--- a/drivers/nvme/target/fabrics-cmd-auth.c
+++ b/drivers/nvme/target/fabrics-cmd-auth.c
@@ -330,6 +330,7 @@ void nvmet_execute_auth_send(struct nvmet_req *req)
 			/* Restart negotiation */
 			pr_debug("%s: ctrl %d qid %d reset negotiation\n",
 				 __func__, ctrl->cntlid, req->sq->qid);
+			nvmet_auth_sq_free(req->sq);
 			if (!req->sq->qid) {
 				dhchap_status = nvmet_setup_auth(ctrl, req->sq,
 								 true);
-- 
2.43.7

Re: [PATCH v2] nvmet: Free the old negotiation state when restarting authentication

[Christoph Hellwig]

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>

Re: [PATCH v2] nvmet: Free the old negotiation state when restarting authentication

[Keith Busch]

On Wed, Oct 28, 2026 at 04:55:51PM +0800, Guixin Liu wrote:
> Restarting a DH-HMAC-CHAP negotiation with SEND(NEGOTIATE) resets
> sq->dhchap_step but does not release the previous c1/c2/skey, which
> are only freed in nvmet_auth_sq_free() at teardown.  The next
> CHALLENGE/REPLY exchange then overwrites those pointers with fresh
> allocations.
> 
> An unauthenticated host can repeat the negotiate message endlessly,
> leaking a few dozen bytes per round and slowly exhausting target
> memory.
> 
> Clear the old negotiation state with nvmet_auth_sq_free() before
> setting up the new one.  Also reset dhchap_skey_len to zero: if a DH
> session key was already established, a following round with dhvlen=0
> would otherwise pass a NULL skey with a stale non-zero length to the
> HMAC code and dereference it.

Thanks, applied to nvme-7.4.