Re: [PATCH] sunrpc: reject AUTH_TLS on backchannel to prevent NULL-deref in svcauth_tls_accept

[Chuck Lever]

On Thu, 24 Sep 2026 21:52:51 -0400, Cen Zhang (Microsoft) wrote:
> svcauth_tls_accept() dereferences rqstp->rq_xprt unconditionally when
> it tests xprt->xpt_ops->xpo_handshake, but on the NFSv4.1 backchannel
> path (svc_process_bc), rq_xprt is NULL because no server-side transport
> exists. A malicious NFS server can send AUTH_TLS (flavor 7) on the
> backchannel to trigger a NULL pointer dereference in the client kernel.
> 
>   general protection fault, probably for non-canonical address
>    0xdffffc0000000001
>   KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
>   RIP: 0010:svcauth_tls_accept+0x258/0x820
>   svc_authenticate+0x2ab/0x3e0
>   svc_process_common+0x8ff/0x1cf0
>   svc_process_bc+0x5a8/0xbb0
>   nfs4_callback_svc+0xcf/0x170
> 
> [...]

Applied to nfsd-testing, thanks!

[1/1] sunrpc: reject AUTH_TLS on backchannel to prevent NULL-deref in svcauth_tls_accept
      commit: 32eb1a60b456980761cf7a9cee8f907fdc08afb8

--
Chuck Lever