Re: [PATCH net 1/1] SUNRPC: reject AUTH_TLS on backchannel requests

svc_process_bc() processes reverse-direction calls with rqstp->rq_xprt
set to NULL. A backchannel caller can supply RPC_AUTH_TLS, which selects
svcauth_tls_accept(). That handler dereferences rq_xprt while checking
for transport handshake support, causing a NULL pointer dereference
before the RPC program can reject the request.

Reject AUTH_TLS credentials when no service transport is present. The
backchannel request is then denied without accessing rq_xprt.

Fixes: 74aaf96feaca ("SUNRPC: Teach server to recognize RPC_AUTH_TLS")
Cc: <redacted>
Reported-by: Vega <redacted>
Assisted-by: LLM
Signed-off-by: Zhiling Zou <redacted>
---
 net/sunrpc/svcauth_unix.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c
index 31a1bc60a5f6d..bac38f3ce9a6c 100644
--- a/net/sunrpc/svcauth_unix.c
+++ b/net/sunrpc/svcauth_unix.c

@@ -1128,6 +1128,11 @@ svcauth_tls_accept(struct svc_rqst *rqstp)
 		rqstp->rq_auth_stat = rpc_autherr_badcred;
 		return SVC_DENIED;
 	}
+	if (unlikely(!xprt)) {
+		/* Backchannel requests do not have a service transport. */
+		rqstp->rq_auth_stat = rpc_autherr_badcred;
+		return SVC_DENIED;
+	}

 	/* Signal that mapping to nobody uid/gid is required */
 	cred->cr_uid = INVALID_UID;

-- 
2.55.0