#255931 NFS fh_verify causes lost output

[Christoph Hellwig <hch@infradead.org>]

We have the following report from Paul Szabo in the Debian bugtracking system,
any chance someone could look into it?  The RedHat bugzilla reference is quite
interesting aswell.

-----------------------------------------------------------------------------
Package: kernel
Version: N/A; reported 2004-06-24
Severity: important
Tags: patch

With default root_squash and subtree_check options, there is a problem with
NFS exports. The bug may appear also with no_root_squash; can always be
avoided with no_subtree_check. The bug causes open filehandles to become
stale, and further read/write access to fail.

References to what I think are the same issue:
http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=110421
http://groups.google.com.au/groups?hl=en&lr=&ie=UTF-8&threadm=fa.jnukgbv.3i82ba%40ifi.uio.no&rnum=3&prev=/groups%3Fq%3Dfh_verify%253A%2Bno%2Broot_squashed%26ie%3DISO-8859-1%26hl%3Den
showing that the problem is not specific to Debian, and is present on a
wide range of kernel versions.

Can reproduce the problem with lsof. Seems that if the "owner" runs lsof,
then root does lsof quite soon, there is no problem; root needs to wait a
while to produce the problem; there seems to be a 10-second cache period.
Demo (see output files vanish if user has NFS-mounted home):

su - psz -c 'sleep 1000 >sleep.out 2>&1 <&- &'            ## Start process
sleep 20; su - psz -c 'lsof -c sl'; sleep 1; lsof -u psz  ## OK (may repeat)
sleep 20; su - psz -c 'lsof -c sl'; sleep 20; lsof -u psz ## Fail

The server will log something like
  kernel: fh_verify: no root_squashed access at psz/sleep.out.

The problem causes loss of output, some or all may be lost e.g. for

sh -c 'echo hello; sleep 200; echo bye' >sh.out &
perl -e 'echo "hello\n"; sleep 200; echo "bye\n"' >pl.out &

The following patch (against kernel-source-2.4.22) seems to fix the
problem:

--- fs/nfsd/nfsfh.c.orig	Sat Aug 30 16:01:44 2003
+++ fs/nfsd/nfsfh.c	Wed Jun 23 12:57:52 2004
@@ -705,11 +705,23 @@
 			/* make sure parents give x permission to user */
 			error = permission(parent->d_inode, MAY_EXEC);
 			if (error)
+/*			{
+				printk("fh_verify: no UID=%d,GID=%d (userset=%d) access to %s at %s/%s\n",
+					current->fsuid, current->fsgid, rqstp->rq_userset,
+				       parent->d_name.name,
+				       dentry->d_parent->d_name.name,
+				       dentry->d_name.name); */
 				break;
+/*			} */
 			tdentry = parent;
 		}
 		if (exp->ex_dentry != tdentry) {
-			error = nfserr_stale;
+			error = nfserr_acces;
+/* PSz 23 Jun 04  Not STALE but ACCES: so NFS client code (RPC really)
+ *                net/sunrpc/clnt.c will handle and re-try as real user,
+ *                do not want fs/nfs/inode.c to remove the inode. */
+/* Should not say root_squashed without checking ROOTSQUASH or ALLSQUASH
+ * and UID/GID. (Probably should be dprintk: lucky it was not.) */
 			printk("fh_verify: no root_squashed access at %s/%s.\n",
 			       dentry->d_parent->d_name.name,
 			       dentry->d_name.name);

Cheers,

Paul Szabo - psz@maths.usyd.edu.au  http://www.maths.usyd.edu.au:8000/u/psz/
School of Mathematics and Statistics  University of Sydney   2006  Australia


-- System Information
Debian Release: 3.0
Architecture: i386
Kernel: Linux pisa.maths.usyd.edu.au 2.4.22-smssvr1.5 #1 SMP Fri Apr 16 13:55:30 EST 2004 i686
Locale: LANG=C, LC_CTYPE=C





-------------------------------------------------------
SF.Net email is sponsored by Shop4tech.com-Lowest price on Blank Media
100pk Sonic DVD-R 4x for only $29 -100pk Sonic DVD+R for only $33
Save 50% off Retail on Ink & Toner - Free Shipping and Free Gift.
http://www.shop4tech.com/z/Inkjet_Cartridges/9_108_r285
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs