Re: [PATCH net 1/4] afs: Fix NULL deref in afs_deliver_cb_init_call_back_state3()

[Jeffrey E Altman <jaltman@auristor.com>]

On 7/2/2026 10:49 AM, David Howells wrote:
> Fix afs_deliver_cb_init_call_back_state3() to avoid a potential NULL deref
> should call->server be NULL (ie. afs_rx_new_call() failed to find a
> matching server record) when it checks the server's UUID.
>
> Fixes: 40e8b52fe8c8 ("afs: Use the per-peer app data provided by rxrpc")
> Link: https://sashiko.dev/#/patchset/20260624163819.3017002-1-dhowells%40redhat.com
> Signed-off-by: David Howells <dhowells@redhat.com>
> cc: Marc Dionne <marc.dionne@auristor.com>
> cc: Jeffrey Altman <jaltman@auristor.com>
> cc: Eric Dumazet <edumazet@google.com>
> cc: "David S. Miller" <davem@davemloft.net>
> cc: Jakub Kicinski <kuba@kernel.org>
> cc: Paolo Abeni <pabeni@redhat.com>
> cc: Simon Horman <horms@kernel.org>
> cc: linux-afs@lists.infradead.org
> cc: stable@kernel.org
> ---
>   fs/afs/cmservice.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c
> index 5540ae1cad59..d579a665e3da 100644
> --- a/fs/afs/cmservice.c
> +++ b/fs/afs/cmservice.c
> @@ -364,7 +364,8 @@ static int afs_deliver_cb_init_call_back_state3(struct afs_call *call)
>   	if (!afs_check_call_state(call, AFS_CALL_SV_REPLYING))
>   		return afs_io_error(call, afs_io_error_cm_reply);
>   
> -	if (memcmp(call->request, &call->server->_uuid, sizeof(call->server->_uuid)) != 0) {
> +	if (call->server &&
> +	    memcmp(call->request, &call->server->_uuid, sizeof(call->server->_uuid)) != 0) {
>   		pr_notice("Callback UUID does not match fileserver UUID\n");
>   		trace_afs_cm_no_server_u(call, call->request);
>   		return 0;

Reviewed-by: Jeffrey Altman <jaltman@auristor.com>