From 96da408bb4a24bf87b366b13f41c2687d3c05671 Mon Sep 17 00:00:00 2001 From: Shao Mingyin Date: Mon, 26 Oct 2026 16:45:26 +0800 Subject: [PATCH] nvmet-auth: fix error handling on CHALLENGE failure In nvmet_execute_auth_receive(), when nvmet_auth_challenge() fails (for example when the initiator-supplied allocation length is shorter than the DH-HMAC-CHAP challenge response, or the challenge nonce allocation fails), the error path sets status = NVME_SC_INTERNAL and breaks out of the switch. The unconditional status = nvmet_copy_to_sgl(req, 0, d, al); after the switch then overwrites the error status (nvmet_copy_to_sgl() returns 0 on success), so the AUTH_RECEIVE command incorrectly completes with SUCCESS and the initiator proceeds with a truncated/empty challenge. Fix this by freeing the buffer and jumping to the common done: label on CHALLENGE failure, skipping the copy_to_sgl() entirely and preserving the NVME_SC_INTERNAL status. Fixes: db1312dd9548 ("nvmet: implement basic In-Band Authentication") Cc: stable@vger.kernel.org Signed-off-by: Shao Mingyin Signed-off-by: Keith Busch --- drivers/nvme/target/fabrics-cmd-auth.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/nvme/target/fabrics-cmd-auth.c b/drivers/nvme/target/fabrics-cmd-auth.c index ff6b73cfe0f9..bc49b48cdd63 100644 --- a/drivers/nvme/target/fabrics-cmd-auth.c +++ b/drivers/nvme/target/fabrics-cmd-auth.c @@ -605,10 +605,11 @@ void nvmet_execute_auth_receive(struct nvmet_req *req) switch (req->sq->dhchap_step) { case NVME_AUTH_DHCHAP_MESSAGE_CHALLENGE: if (nvmet_auth_challenge(req, d, al) < 0) { - pr_warn("ctrl %d qid %d: challenge error (%d)\n", - ctrl->cntlid, req->sq->qid, status); + pr_warn("ctrl %d qid %d: challenge error\n", + ctrl->cntlid, req->sq->qid); status = NVME_SC_INTERNAL; - break; + kfree(d); + goto done; } req->sq->dhchap_step = NVME_AUTH_DHCHAP_MESSAGE_REPLY; break;