svc_process_bc() processes reverse-direction calls with rqstp->rq_xprt set to NULL. A backchannel caller can supply RPC_AUTH_TLS, which selects svcauth_tls_accept(). That handler dereferences rq_xprt while checking for transport handshake support, causing a NULL pointer dereference before the RPC program can reject the request. Reject AUTH_TLS credentials when no service transport is present. The backchannel request is then denied without accessing rq_xprt. Fixes: 74aaf96feaca ("SUNRPC: Teach server to recognize RPC_AUTH_TLS") Cc: stable@vger.kernel.org Reported-by: Vega Assisted-by: LLM Signed-off-by: Zhiling Zou --- net/sunrpc/svcauth_unix.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c index 31a1bc60a5f6d..bac38f3ce9a6c 100644 --- a/net/sunrpc/svcauth_unix.c +++ b/net/sunrpc/svcauth_unix.c @@ -1128,6 +1128,11 @@ svcauth_tls_accept(struct svc_rqst *rqstp) rqstp->rq_auth_stat = rpc_autherr_badcred; return SVC_DENIED; } + if (unlikely(!xprt)) { + /* Backchannel requests do not have a service transport. */ + rqstp->rq_auth_stat = rpc_autherr_badcred; + return SVC_DENIED; + } /* Signal that mapping to nobody uid/gid is required */ cred->cr_uid = INVALID_UID; -- 2.55.0