7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Sung Byeongchan [ Upstream commit 44512543ff0413031516a02cde67323a55e0f769 ] I/O queues do not perform independent DH-HMAC-CHAP authentication. They instead rely on authentication of the controller's admin queue. Fabrics property commands, however, are dispatched before the general admin command authentication check. An unauthenticated peer can consequently set CC.EN, connect an I/O queue, and access a namespace after admin CONNECT reported that authentication was required. Reject PROPERTY_SET until the admin queue has authenticated. Targets without a configured authentication key are unchanged. This was found by source review with AI assistance. A localhost NVMe/TCP wire reproducer retrieved a known 4 KiB namespace block in two independent boots without completing AUTH_SEND or AUTH_RECEIVE. With this change, PROPERTY_SET returned NVME_SC_AUTH_REQUIRED and the namespace data was not returned; the no-authentication control continued to work. Fixes: c91a20129185 ("nvmet-auth: authenticate on admin queue only") Cc: stable@vger.kernel.org Assisted-by: LLM Reviewed-by: Christoph Hellwig Signed-off-by: Sung Byeongchan Signed-off-by: Keith Busch Signed-off-by: Sasha Levin --- drivers/nvme/target/fabrics-cmd.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/nvme/target/fabrics-cmd.c b/drivers/nvme/target/fabrics-cmd.c index 42d1d18116715..b451029ab8f49 100644 --- a/drivers/nvme/target/fabrics-cmd.c +++ b/drivers/nvme/target/fabrics-cmd.c @@ -14,6 +14,10 @@ static void nvmet_execute_prop_set(struct nvmet_req *req) if (!nvmet_check_transfer_len(req, 0)) return; + if (!nvmet_check_auth_status(req)) { + status = NVME_SC_AUTH_REQUIRED | NVME_STATUS_DNR; + goto out; + } if (req->cmd->prop_set.attrib & 1) { req->error_loc = -- 2.53.0