Re: [PATCH] SUNRPC: avoid possible page reuse from svcauth_gss_wrap_integ()

[Chuck Lever]

On Thu, Oct 22, 2026, at 9:10 AM, Michael Lowman via B4 Relay wrote:
> From: Michael Lowman <michael.d.lowman@xxxxxxxxx>
>
> Commit 7702378ac4d4 ("SUNRPC: Convert svcauth_gss_wrap_integ() to
> use xdr_stream()") and its parent changed from calculating the
> integrity checksum in-place in an unused part of the response buffer
> to calculating in a scratch buffer and appending it to the response
> stream. While the unused part of the response buffer happened to
> always end on the first page, the append always occurs on the last.
>
> If less than 32 bytes remain before the page boundary, some or all
> of the checksum will be written to the next page. But since the xdr
> functions do not update the response's page accounting, the page
> will be immediately available for reuse. Data from another request
> will overwrite the portion of the checksum on the new page.
>
> Avoid this by marking the page as used when needed.
>
> Signed-off-by: Michael Lowman <michael.d.lowman@xxxxxxxxx>
> Fixes: 7702378ac4d4 ("SUNRPC: Convert svcauth_gss_wrap_integ() to use 
> xdr_stream()")

Commit d1eafc3bab9f "SUNRPC: in svcauth_gss_wrap_integ() resync
rq_next_page after the GSS wrap", now in the nfsd-testing branch,
already addresses this issue. Thanks for confirming the finding!


-- 
Chuck Lever (Come to NFS bake-a-thon! https://nfsv4bat.org)