Re: [PATCH] scsi: target: iscsi: Check for existing sessions only after authentication

[Martin K. Petersen (Oracle)]

On Thu, 29 Oct 2026 13:54:56 -0700, Praneeth Balasubramanian wrote:

> In the operational-negotiation path (CSG=1),
> iscsi_target_handle_csg_one() calls
> iscsi_target_check_for_existing_instances() before
> iscsi_conn_authenticated(). An initiator can therefore send a first
> Login PDU with CSG=1, TSIH=0 and no CHAP exchange, carrying the
> InitiatorName and ISID of an existing session. The target reinstates
> that session, which tears down the legitimate initiator's connection.
> Only afterwards does it reject the login with AUTH_FAILED.
> 
> [...]

Applied to 7.4/scsi-fixes, thanks!

[1/1] scsi: target: iscsi: Check for existing sessions only after authentication
      https://git.kernel.org/mkp/scsi/c/48d3b732e5ad

-- 
Martin K. Petersen