svc_defer() misses the rq_arg.len vs head[0].iov_len check, so a
crafted RPCSEC_GSS packet can make the deferred snapshot no longer be
the original request.

Since deferred replays skip GSS verification, this may lead to an
authentication bypass.

Reported-by: Kimi Security Team <bug-report@moonshot.ai>
Signed-off-by: Yilin Zhang <yilinzhang@moonshot.ai>
---
 net/sunrpc/svc_xprt.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -1282,5 +1282,7 @@ static struct cache_deferred_req *svc_defer(struct cache_req *req)
 	if (rqstp->rq_arg.page_len || !test_bit(RQ_USEDEFERRAL, &rqstp->rq_flags))
 		return NULL; /* if more than a page, give up FIXME */
+	if (rqstp->rq_arg.len < rqstp->rq_arg.head[0].iov_len)
+		return NULL; /* inconsistent lengths */
 	if (rqstp->rq_deferred) {
 		dr = rqstp->rq_deferred;
 		rqstp->rq_deferred = NULL;