[BUG] drivers/nvme: out-of-bounds in nvmet_execute_auth_receive()

[co]

This is a bug report, not a patch submission.

We found a bug reachable in:

    path    drivers/nvme/target
    crash   out-of-bounds in nvmet_execute_auth_receive()
    commit  2f1baf1fc892 ("Merge tag 'trace-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace")

Config, environment, the sanitizer report and a C reproducer follow.

== Notes ===============================================================
    If you fix this bug, this tag credits the report and lets us
    close it on our side:

Reported-by: co+77553a7fc66ac133@xxxxxxx

    Everything in this mail is validated by the reproducer below.

    We also hold an unreviewed LLM-generated analysis and candidate
    patch. The same reproducer panics the unpatched kernel and runs
    clean with that patch applied. Use it as a starting point, or ignore
    it and write your own:

        patch.diff  https://bugs.sh/b/77553a7fc66ac133/patch.diff
        report.md   https://bugs.sh/b/77553a7fc66ac133/report.md

    Happy to test patches. Complaints and suggestions about our work
    are welcome at:

        cedalion@xxxxxxx

== Environment =========================================================
    Reproduced on  2f1baf1fc892 ("Merge tag 'trace-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace")
    VM setup       https://bugs.sh/b/77553a7fc66ac133/run.sh
    config         https://bugs.sh/b/77553a7fc66ac133/config.gz
    poc            https://bugs.sh/b/77553a7fc66ac133/repro.c

== Sanitizer Report ====================================================
BUG: KASAN: slab-out-of-bounds in nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:451 drivers/nvme/target/fabrics-cmd-auth.c:578)
Write of size 32 at addr ffff88802363c790 by task kworker/1:0H/26
CPU: 1 UID: 0 PID: 26 Comm: kworker/1:0H Not tainted 7.3.0-rc1 #2 PREEMPT(full)
Workqueue: nvmet_tcp_wq nvmet_tcp_io_work
Call Trace:
dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
kasan_report (mm/kasan/report.c:595)
kasan_check_range (mm/kasan/generic.c:186 mm/kasan/generic.c:200)
__asan_memcpy (mm/kasan/shadow.c:106 (discriminator 1))
nvmet_execute_auth_receive (drivers/nvme/target/fabrics-cmd-auth.c:451 drivers/nvme/target/fabrics-cmd-auth.c:578)
nvmet_tcp_try_recv_pdu (drivers/nvme/target/tcp.c:1134 drivers/nvme/target/tcp.c:1258)
nvmet_tcp_io_work (drivers/nvme/target/tcp.c:1365 drivers/nvme/target/tcp.c:1397 drivers/nvme/target/tcp.c:1460)
process_one_work (kernel/workqueue.c:3396)
worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Allocated by task 26:
kasan_save_stack (mm/kasan/common.c:57)
kasan_save_track (mm/kasan/common.c:78)
__kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)
__kmalloc_noprof (./include/linux/kasan.h:263 mm/slub.c:5414 mm/slub.c:5439)
nvmet_execute_auth_receive (./include/linux/slab.h:995 ./include/linux/slab.h:1312 drivers/nvme/target/fabrics-cmd-auth.c:569)
nvmet_tcp_try_recv_pdu (drivers/nvme/target/tcp.c:1134 drivers/nvme/target/tcp.c:1258)
nvmet_tcp_io_work (drivers/nvme/target/tcp.c:1365 drivers/nvme/target/tcp.c:1397 drivers/nvme/target/tcp.c:1460)
process_one_work (kernel/workqueue.c:3396)
worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
The buggy address belongs to the object at ffff88802363c780
which belongs to the cache kmalloc-64 of size 64
The buggy address is located 16 bytes inside of
allocated 33-byte region [ffff88802363c780, ffff88802363c7a1)


---
The report format is based on syzbot bug report.

This report is generated by a bot. It may contain errors.
See https://github.com/n132/cedalion for more information.

For any issue with this report, reach out to cedalion@xxxxxxx

If the report is already addressed, let us know by replying with:
#co fix: <commit hash>

If the report is a duplicate of another one, reply with:
#co dup: <lore link>

If you want to undo deduplication, reply with:
#co undup