git: 4d015c4c3f94 - stable/14 - clnt_vc.c: Fix handling of backchannel xprt

The branch stable/14 has been updated by rmacklem:

URL: https://cgit.FreeBSD.org/src/commit/?id=4d015c4c3f94494c05c1cad936dce6dab2501f21

commit 4d015c4c3f94494c05c1cad936dce6dab2501f21
Author:     Rick Macklem <rmacklem@FreeBSD.org>
AuthorDate: 2026-10-04 20:29:43 +0000
Commit:     Rick Macklem <rmacklem@FreeBSD.org>
CommitDate: 2026-10-11 03:04:09 +0000

    clnt_vc.c: Fix handling of backchannel xprt
    
    When clnt_vc_destroy() is called, it might not be the
    current connection.  Without this patch, if it is not
    the current connection, xp_p2 is set NULL and xprt is released
    when it should not be released.
    
    This patch adds a check for "current connection" to fix
    the problem.  Found during testing to the client RDMA code,
    but could happen for TCP as well.
    
    (cherry picked from commit 81a6514689cefdaa5c92b5539ae885ec8c6b3336)
---
 sys/rpc/clnt_vc.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/sys/rpc/clnt_vc.c b/sys/rpc/clnt_vc.c
index cc2471f95e8c..03fb27e8be36 100644
--- a/sys/rpc/clnt_vc.c
+++ b/sys/rpc/clnt_vc.c
@@ -865,6 +865,7 @@ clnt_vc_destroy(CLIENT *cl)
 	struct socket *so = NULL;
 	SVCXPRT *xprt;
 	uint32_t reterr;
+	bool_t rlse;
 
 	clnt_vc_close(cl);
 
@@ -873,11 +874,16 @@ clnt_vc_destroy(CLIENT *cl)
 	ct->ct_backchannelxprt = NULL;
 	if (xprt != NULL) {
 		mtx_unlock(&ct->ct_lock);	/* To avoid a LOR. */
+		rlse = FALSE;
 		sx_xlock(&xprt->xp_lock);
 		mtx_lock(&ct->ct_lock);
-		xprt->xp_p2 = NULL;
+		if (xprt->xp_p2 == ct) {
+			xprt->xp_p2 = NULL;
+			rlse = TRUE;
+		}
 		sx_xunlock(&xprt->xp_lock);
-		SVC_RELEASE(xprt);
+		if (rlse)
+			SVC_RELEASE(xprt);
 	}
 
 	if (ct->ct_socket) {