Re: [PATCH] SUNRPC: fix oversized GSS proxy token copy

[Chuck Lever]

On Thu, 10 Sep 2026 12:51:20 +0000, Jérémy Jean wrote:
> gss_read_proxy_verf() allocates one page per token chunk, but it copies the
> entire linear head of an RPC request into in_token->pages[0]. A UDP datagram
> can leave more than PAGE_SIZE bytes in the linear head, so a large
> RPCSEC_GSS INIT token overwrites following pages.
> 
> Copy the linear head in page-sized chunks before switching to the request
> page array. The linear head itself can span multiple pages.
> 
> [...]

Applied to nfsd-testing, thanks!

[1/1] SUNRPC: fix oversized GSS proxy token copy
      commit: c01472559c0e38174c89d86adc698cae0551cae6

--
Chuck Lever