Re: [PATCH] nvmet-auth: reject overlong negotiate identifier lists

[Keith Busch]

On Mon, Aug 10, 2026 at 03:56:15PM +0000, Jérémy Jean wrote:
> The DH-HMAC-CHAP NEGOTIATE descriptor carries separate lengths for the
> hash and DH identifier lists, but each list occupies a fixed 30-byte half
> of idlist[]. nvmet_auth_negotiate() uses halen and dhlen from the wire as
> loop bounds without validating them, so a remote initiator can make the
> target read past the 72-byte request buffer. KASAN reports a 
> slab-out-of-bounds read in nvmet_execute_auth_send().
> 
> Reject list lengths above the protocol maxima before either loop
> indexes idlist[].

This should already be fixed with the inclusion of this one:

https://lore.kernel.org/linux-nvme/20260804033800.3975537-1-kanie@xxxxxxxxxxxxxxxxx/