Re: [PATCH 1/1] dm-integrity: replace forgeable discard filler with a keyed sector marker

[Mikulas Patocka <mpatocka@redhat.com>]

On Mon, 27 Jul 2026, Shukai Ni wrote:

> The discard-block check in dm_integrity_rw_tag() treats a stored tag
> of all 0xf6 bytes (DISCARD_FILLER) as proof a block was discarded and
> skips HMAC verification. allow_discards is only accepted in
> dm-integrity's standalone mode. An attacker with raw write access to
> the backing device, but without the integrity key, can stamp any block
> with an all-0xf6 tag and have it served as authentic.
> 
> Replace the constant filler with a keyed checksum of (salt || sector)
> and no block payload, computed by integrity_discard_checksum().
> 
> Fixes: 84597a44a9d8 ("dm integrity: add optional discard support")
> Co-developed-by: Jo Van Bulck <jo.vanbulck@cs.kuleuven.be>
> Signed-off-by: Jo Van Bulck <jo.vanbulck@cs.kuleuven.be>
> Signed-off-by: Shukai Ni <shukai.ni@kuleuven.be>

Hi

This breaks backward compatibility for existing volumes. I would add a new 
option "allow_discards_keyed" that enables this functionality (and store 
this option also as a flag in the superblock, so that it can't be turned 
off).

Mikulas