[PATCH] sunrpc: reject AUTH_TLS on backchannel to prevent NULL-deref in svcauth_tls_accept

[Cen Zhang (Microsoft)]

svcauth_tls_accept() dereferences rqstp->rq_xprt unconditionally when
it tests xprt->xpt_ops->xpo_handshake, but on the NFSv4.1 backchannel
path (svc_process_bc), rq_xprt is NULL because no server-side transport
exists. A malicious NFS server can send AUTH_TLS (flavor 7) on the
backchannel to trigger a NULL pointer dereference in the client kernel.

  general protection fault, probably for non-canonical address
   0xdffffc0000000001
  KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
  RIP: 0010:svcauth_tls_accept+0x258/0x820
  svc_authenticate+0x2ab/0x3e0
  svc_process_common+0x8ff/0x1cf0
  svc_process_bc+0x5a8/0xbb0
  nfs4_callback_svc+0xcf/0x170

Reject AUTH_TLS early when rq_xprt is NULL, since TLS transport
upgrade is meaningless on the backchannel which has no svc_xprt.

Fixes: 74aaf96feaca ("SUNRPC: Teach server to recognize RPC_AUTH_TLS")
Reported-by: AutonomousCodeSecurity@xxxxxxxxxxxxx
Reviewed-by: Francis Perron <francis@xxxxxxxxxxx>
Signed-off-by: Cen Zhang (Microsoft) <cenzhang@xxxxxxxxxxxxxxxxxxx>
Assisted-by: GitHub-Copilot:claude-opus-4.6
---
 net/sunrpc/svcauth_unix.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c
index 31a1bc60a5f6..42149139e58d 100644
--- a/net/sunrpc/svcauth_unix.c
+++ b/net/sunrpc/svcauth_unix.c
@@ -1129,6 +1129,12 @@ svcauth_tls_accept(struct svc_rqst *rqstp)
 		return SVC_DENIED;
 	}
 
+	/* AUTH_TLS is not valid on backchannel (rq_xprt is NULL) */
+	if (!xprt) {
+		rqstp->rq_auth_stat = rpc_autherr_badcred;
+		return SVC_DENIED;
+	}
+
 	/* Signal that mapping to nobody uid/gid is required */
 	cred->cr_uid = INVALID_UID;
 	cred->cr_gid = INVALID_GID;

-- 
2.55.0