Re: [PATCH 0/6] Harden server-side RPCSEC GSS decode and backchannel teardown

On Thu, 2026-05-28 at 15:32 -0400, Chuck Lever wrote:
> Address findings from an audit of how the server-side RPCSEC GSS
> accept path handles partially decoded and stale credential state.
> The common defect class: gss_svc_data and the rpc_gss_wire_cred it
> embeds (svcdata->clcred) are allocated with non-zeroing kmalloc and
> reused across requests, so an early decode failure leaves this
> request's partial writes mixed with the previous request's residue
> for a later consumer to trust.
> 
> The two gssx option-array decoder patches carry a hard ordering
> dependency. The error-path fix must come first: it wires
> free_svc_cred() into free_creds: and converts the out_free_groups:
> teardown to the refcount-aware put_group_info(). Only once that
> refcount-aware free path exists does rejecting a duplicate CREDS_VALUE
> option actually release the single installed group_info instead of
> leaking it. Reviewed out of order, the duplicate-rejection patch looks
> incomplete.
> 
> The backchannel patch stands apart from the GSS decode work: a genuine
> race and use-after-free in callback-service teardown. It closes the
> producer side -- clearing xprt->bc_serv under bc_pa_lock -- before the
> callback threads stop, then drains any request that raced in before
> svc_destroy() frees the service.
> 
> ---
> Chris Mason (4):
>       SUNRPC: fix gssx_dec_option_array error path bugs
>       SUNRPC: reject duplicate CREDS_VALUE options
>       SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat
>       SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry
> 
> Chuck Lever (2):
>       SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field
>       SUNRPC: close backchannel before destroying callback service
> 
>  fs/nfs/callback.c                   |  4 +++-
>  include/linux/sunrpc/bc_xprt.h      |  5 +++++
>  net/sunrpc/auth_gss/gss_krb5_wrap.c |  2 ++
>  net/sunrpc/auth_gss/gss_rpc_xdr.c   | 15 ++++++++++++---
>  net/sunrpc/auth_gss/svcauth_gss.c   |  5 +++++
>  net/sunrpc/backchannel_rqst.c       | 38 ++++++++++++++++++++++++++++++-------
>  6 files changed, 58 insertions(+), 11 deletions(-)
> ---
> base-commit: 4d4d6605de5f91a40335729b6a7cc15e83b280f3
> change-id: 20260528-tier2-d0dedb949b3d
> 
> Best regards,
> --  
> Chuck Lever <[email protected]>

Reviewed-by: Jeff Layton <[email protected]>