Patch "sunrpc: fix stripping of padded MIC tokens" has been added to the 4.6-stable tree

This is a note to let you know that I've just added the patch titled

sunrpc: fix stripping of padded MIC tokens

to the 4.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
sunrpc-fix-stripping-of-padded-mic-tokens.patch
and it can be found in the queue-4.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Trnka?= <[email protected]>
Date: Fri, 20 May 2016 16:41:10 +0200
Subject: sunrpc: fix stripping of padded MIC tokens
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

From: Tomáš Trnka <[email protected]>

commit c0cb8bf3a8e4bd82e640862cdd8891400405cb89 upstream.

The length of the GSS MIC token need not be a multiple of four bytes. It is then padded by XDR to a multiple of 4 B, but unwrap_integ_data() would previously only trim mic.len + 4 B. The remaining up to three bytes would then trigger a check in nfs4svc_decode_compoundargs(), leading to a "garbage args" error and mount failure:

nfs4svc_decode_compoundargs: compound not properly padded!
nfsd: failed to decode arguments!

This would prevent older clients using the pre-RFC 4121 MIC format (37-byte MIC including a 9-byte OID) from mounting exports from v3.9+ servers using krb5i.

The trimming was introduced by commit 4c190e2f913f ("sunrpc: trim off trailing checksum before returning decrypted or integrity authenticated buffer").

---
 net/sunrpc/auth_gss/svcauth_gss.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

@@ -857,8 +857,8 @@ unwrap_integ_data(struct svc_rqst *rqstp
 		goto out;
 	if (svc_getnl(&buf->head[0]) != seq)
 		goto out;
-	/* trim off the mic at the end before returning */
-	xdr_buf_trim(buf, mic.len + 4);
+	/* trim off the mic and padding at the end before returning */
+	xdr_buf_trim(buf, round_up_to_quad(mic.len) + 4);
 	stat = 0;
 out:
 	kfree(mic.data);

Patches currently in stable-queue which might be from [email protected] are

queue-4.6/sunrpc-fix-stripping-of-padded-mic-tokens.patch