[BUG] nfs4 client loops printing "Error: state manager encountered RPCSEC_GSS session expired" if kerberos ticket expires

[BUG] nfs4 client loops printing "Error: state manager encountered RPCSEC_GSS session expired" if kerberos ticket expires

[John Hughes]

We mount user home directories (using automount) from an nfs4 server 
with sec=krb5.

Using older kernels (2.6.32 for example) when the user ticket expires 
attempts to access the mount get EPERM.  This is no big deal, the 
workstation is probably in the screensaver so the user enters her 
password, a new ticket is granted and everything carries on.

At some point (before or after 2.6.39) this behaviour changed.

Now attempts to access the mount point hang and an endless stream of:

Error: state manager encountered RPCSEC_GSS session expired against NFSv4 server xxxx


messages is printed to the kernel log.  The user doesn't get prompted 
for a password and can only get a new ticket by moving to a text console 
and logging in again (which unblocks things).

(This is Debian bug 
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=648155 and Ubuntu bug 
https://bugs.launchpad.net/ubuntu/+bug/794112 ).

The client is Debian Sid, with kernel 3.1.0-rc10 on a Dell core i5 based 
Optiplex 390.  (The same problem occurs in the standard Debian 3.0 kernel).

Linux cretic 3.1.0-rc10 #1 SMP Thu Nov 10 11:45:46 CET 2011 x86_64 GNU/Linux

The server is Debian Squeeze, kernel 2.6.32.

What should I be trying to do to debug this?

Re: [BUG] nfs4 client loops printing "Error: state manager encountered RPCSEC_GSS session expired" if kerberos ticket expires

[John Hughes]

[-- Attachment #1: Type: text/plain, Size: 631 bytes --]

Here is a ridiculously stupid patch that fixes the behaviour to be 
closer to what I want.

Now, if the krb5 ticket has expired processes get a EKEYEXPIRED error 
and the kernel doesn't waste its time printing "ticket expired" errors.

 From the point of view of someone who has their home directory nfs 
mounted they go home after work, when they get back in the morning they 
give their password to the screensaver, pam_krb5 gets a new ticket and 
everything works.

(Without this hack the screensaver hangs before presenting the password 
prompt, presumably accessing something in the home directory).

Anyone care to comment?


[-- Attachment #2: nfs4-hack.patch --]
[-- Type: text/x-patch, Size: 1366 bytes --]

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 4700fae..3101f84 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -302,7 +302,9 @@ static int nfs4_handle_exception(struct nfs_server *server, int errorcode, struc
 			}
 		case -NFS4ERR_GRACE:
 		case -NFS4ERR_DELAY:
+#if 0			/* JH hack - don't handle KRB5 ticket expiry */
 		case -EKEYEXPIRED:
+#endif
 			ret = nfs4_delay(server->client, &exception->timeout);
 			if (ret != 0)
 				break;
@@ -3732,7 +3734,9 @@ nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server,
 		case -NFS4ERR_DELAY:
 			nfs_inc_server_stats(server, NFSIOS_DELAY);
 		case -NFS4ERR_GRACE:
+#if 0			/* JH hack - don't handle KRB5 ticket expiry */
 		case -EKEYEXPIRED:
+#endif
 			rpc_delay(task, NFS4_POLL_RETRY_MAX);
 			task->tk_status = 0;
 			return -EAGAIN;
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 39914be..0137ec9 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1376,10 +1376,12 @@ static int nfs4_recovery_handle_error(struct nfs_client *clp, int error)
 			set_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state);
 			/* Zero session reset errors */
 			return 0;
+#if 0			/* JH hack: If there is nothing to do, do nothing */
 		case -EKEYEXPIRED:
 			/* Nothing we can do */
 			nfs4_warn_keyexpired(clp->cl_hostname);
 			return 0;
+#endif
 	}
 	return error;
 }

Re: [BUG] nfs4 client loops printing "Error: state manager encountered RPCSEC_GSS session expired" if kerberos ticket expires

[John Hughes]

[-- Attachment #1: Type: text/plain, Size: 670 bytes --]

On 14/11/11 15:33, John Hughes wrote:
> Here is a ridiculously stupid patch that fixes the behaviour to be 
> closer to what I want.
>
> Now, if the krb5 ticket has expired processes get a EKEYEXPIRED error 
> and the kernel doesn't waste its time printing "ticket expired" errors.
A slight modification of the patch is needed to avoid scads of "state 
manager failed" errors, if we get EKEYEXPIRED in 
nfs4_recovery_handle_error we *should* return zero, but we don't want to 
call nfs4_warn_keyexpired (there is no reason to log this, it's not a 
kernel problem).

Here's a cleaner version of the patch.

Does anybody care about this?  Will anybody read this message?


[-- Attachment #2: nfs4-ekeyexpired.patch --]
[-- Type: text/x-patch, Size: 1232 bytes --]

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 4700fae..dc28a78 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -302,7 +302,6 @@ static int nfs4_handle_exception(struct nfs_server *server, int errorcode, struc
 			}
 		case -NFS4ERR_GRACE:
 		case -NFS4ERR_DELAY:
-		case -EKEYEXPIRED:
 			ret = nfs4_delay(server->client, &exception->timeout);
 			if (ret != 0)
 				break;
@@ -3732,7 +3731,6 @@ nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server,
 		case -NFS4ERR_DELAY:
 			nfs_inc_server_stats(server, NFSIOS_DELAY);
 		case -NFS4ERR_GRACE:
-		case -EKEYEXPIRED:
 			rpc_delay(task, NFS4_POLL_RETRY_MAX);
 			task->tk_status = 0;
 			return -EAGAIN;
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 39914be..2bee41e 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1377,8 +1377,9 @@ static int nfs4_recovery_handle_error(struct nfs_client *clp, int error)
 			/* Zero session reset errors */
 			return 0;
 		case -EKEYEXPIRED:
-			/* Nothing we can do */
-			nfs4_warn_keyexpired(clp->cl_hostname);
+			/* Nothing we can do, so do nothing.  Don't even
+			   print a warning message, this is not a kernel
+			   problem */
 			return 0;
 	}
 	return error;