Re: [RFC PATCH 0/2] quota evasion test and nfs helpers

[Jeff Layton <jlayton@kernel.org>]

On Mon, 2026-09-07 at 18:40 +0200, cem@kernel.org wrote:
> From: Carlos Maiolino <cem@kernel.org>
> 
> Hi folks.
> 
> I'm flagging these as RFC because I'd like an input in the approach I
> took here regarding how to setup a local nfs-server to reproduce the bug
> recently fixed on xfs quotas.
> 
> The issue is regarding how we checked the credentials before proceeding
> with quota enforcement / or not. And due the chgrp() being run through a
> NSF share, xfs used the wrong credentials allowing an user to evade
> quotas.
> 
> The TL;DR; for the approach is:
> 	- setup a xfs fs with an user belonging to two groups with group
> 	  quotas enforced
> 	- Setup a local nfs server/client and mount it locally through
> 	  loopback
> 	- use the user to fill in the share until it exceeds quota
> 	- change group of the file to the second group.
> 	- repeat a couple times until the second group quota is
> 	  exceeded.
> 
> I'm using the already existing user/groups. The tests uses exportfs directly
> instead of seeting up a exports file, and I added a few new helpers to
> start/stop nfsd and rpcbind. The latter I did as an attempt to make the test
> systemd-agnostic. It is working even if nfs-server systemd service is disabled,
> but I didn't try on a systemd-less OS.
> 
> While writing it I stumped on a weird issue that I'm not exactly sure
> how to fix (or if it's perhaps a bug on umount):
> 
> During cleanup(), I umount the share and unexport the it so the rest
> of the generic cleanup can take place, specially umounting the scratch
> fs There is some timing though required by umount() to properly cleanup
> internal kernel structures before it can be unexported. I honestly
> assumed umount() was synchronous (unless lazy umount) and once it returned
> it was "done". But for some reason I didn't dig into, I need to wait a
> bit between unmounting the share and unexporting it.
> I tried to wait until the mount was excluded from /proc/mounts but even
> after the mount is gone, something still holds the share a bit
> preventing it to be unexported. So I went with a 2 second sleep :)
> 

It may be that nfsd still has some state held here that is being
cleaned up. Chuck has a patchset in progress that may help this:

https://lore.kernel.org/linux-nfs/20260419-umount-kills-nfsv4-state-v9-0-0660bd06d2b6@oracle.com/


> Overall the test works, passing on a patched kernel or failing
> otherwise.
> 
> Comments? Flames? Stones?
> 
> Cheers.
> 
> Carlos Maiolino (2):
>   common/nfs: add management helpers
>   generic: add test for quota enforcement via a nfs share
> 
>  common/nfs            |  55 ++++++++++++++++++++++
>  tests/generic/803     | 106 ++++++++++++++++++++++++++++++++++++++++++
>  tests/generic/803.out |   2 +
>  3 files changed, 163 insertions(+)
>  create mode 100755 tests/generic/803
>  create mode 100644 tests/generic/803.out

-- 
Jeff Layton <jlayton@kernel.org>