Harden server-side RPCSEC GSS decode and backchannel teardown

Address findings from an audit of how the server-side RPCSEC GSS
accept path handles partially decoded and stale credential state.
The common defect class: gss_svc_data and the rpc_gss_wire_cred it
embeds (svcdata->clcred) are allocated with non-zeroing kmalloc and
reused across requests, so an early decode failure leaves this
request's partial writes mixed with the previous request's residue
for a later consumer to trust.

The two gssx option-array decoder patches carry a hard ordering
dependency. The error-path fix must come first: it wires
free_svc_cred() into free_creds: and converts the out_free_groups:
teardown to the refcount-aware put_group_info(). Only once that
refcount-aware free path exists does rejecting a duplicate CREDS_VALUE
option actually release the single installed group_info instead of
leaking it. Reviewed out of order, the duplicate-rejection patch looks
incomplete.

The backchannel patch stands apart from the GSS decode work: a genuine
race and use-after-free in callback-service teardown. It closes the
producer side -- clearing xprt->bc_serv under bc_pa_lock -- before the
callback threads stop, then drains any request that raced in before
svc_destroy() frees the service.

---
Chris Mason (4):
      SUNRPC: fix gssx_dec_option_array error path bugs
      SUNRPC: reject duplicate CREDS_VALUE options
      SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat
      SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry

Chuck Lever (2):
      SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field
      SUNRPC: close backchannel before destroying callback service

 fs/nfs/callback.c                   |  4 +++-
 include/linux/sunrpc/bc_xprt.h      |  5 +++++
 net/sunrpc/auth_gss/gss_krb5_wrap.c |  2 ++
 net/sunrpc/auth_gss/gss_rpc_xdr.c   | 15 ++++++++++++---
 net/sunrpc/auth_gss/svcauth_gss.c   |  5 +++++
 net/sunrpc/backchannel_rqst.c       | 38 ++++++++++++++++++++++++++++++-------
 6 files changed, 58 insertions(+), 11 deletions(-)
---
base-commit: 4d4d6605de5f91a40335729b6a7cc15e83b280f3
change-id: 20260528-tier2-d0dedb949b3d

Best regards,
--  
Chuck Lever <chuck.lever@oracle.com>