From: Benjamin Coddington Date: Mon, 22 Mar 2021 18:37:01 +0000 (-0400) Subject: SUNRPC: Ensure the transport backchannel association X-Git-Tag: v5.13-rc1~21^2~73 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=98b5cee37389b899de044bc4aac56e6ff33dbd4d;p=thirdparty%2Flinux.git SUNRPC: Ensure the transport backchannel association If the server sends CB_ calls on a connection that is not associated with the backchannel, refuse to process the call and shut down the connection. This avoids a NULL dereference crash in xprt_complete_bc_request(). There's not much more we can do in this situation unless we want to look into allowing all connections to be associated with the fore and back channel. Signed-off-by: Benjamin Coddington Signed-off-by: Trond Myklebust --- diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c index a64f5ed1edb4c..47aa47a2b07c5 100644 --- a/net/sunrpc/xprtsock.c +++ b/net/sunrpc/xprtsock.c @@ -558,6 +558,10 @@ xs_read_stream_call(struct sock_xprt *transport, struct msghdr *msg, int flags) struct rpc_rqst *req; ssize_t ret; + /* Is this transport associated with the backchannel? */ + if (!xprt->bc_serv) + return -ESHUTDOWN; + /* Look up and lock the request corresponding to the given XID */ req = xprt_lookup_bc_request(xprt, transport->recv.xid); if (!req) {