Re: [PATCH 5/5] SUNRPC: Set up the servername before the transport is created

[sashiko-bot@kernel.org]

> xprt_create_transport() checks the servername length and copies the
> string only after the class setup() routine has returned. A
> backchannel setup() routine publishes the new transport in the
> svc_xprt's xpt_bc_xprt field before it returns, and svc_xprt_free()
> puts that pointer when the svc_xprt goes away. When the length
> check or the kstrdup() then fails, xprt_create_transport() calls
> xprt_destroy(), which ignores the reference count and frees the
> transport. xpt_bc_xprt is left pointing at freed memory, and
> svc_xprt_free() later puts a dangling reference.
> 
> The setup() routines never read the servername, so validate and
> duplicate it before the transport is created. After the change, no
> failure remains between setup() and the return, and the
> xprt_destroy() calls on the error path go away with it.
> 
> Fixes: 4e0038b6b246 ("SUNRPC: Move clnt->cl_server into struct rpc_xprt")
> Cc: stable@vger.kernel.org
> Signed-off-by: Chuck Lever <cel@kernel.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261104-liange-v1-0-f097e10cea1b@kernel.org?part=5