Bug 537193
| Summary: | Expired krb5 credentials on a v4 share for one user will cause reads from all other users to hang | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 5 | Reporter: | Sachin Prabhu <sprabhu> |
| Component: | kernel | Assignee: | Steve Dickson <steved> |
| Status: | CLOSED WONTFIX | QA Contact: | Red Hat Kernel QE team <kernel-qe> |
| Severity: | high | Docs Contact: | |
| Priority: | medium | ||
| Version: | 5.4 | CC: | aleksey, bfields, jackyc, jlayton, klaus.steinberger, rdassen, rwheeler, shshaikh, steved, tao |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-10-03 15:04:24 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Attachments: | |||
|
Description
Sachin Prabhu
2009-11-12 18:41:09 UTC
Reproducer: - Configure NFSv4 server with kerberos authentication. Here we have three systems. NFSv4 server, client and kerberos server. All these three systems are running RHEL-5.4. 2.6.18-164.el5 - On the nfs server and client create two users as below and set them a password. # useradd -u 5100 nfsuser # useradd -u 5101 nfsuser1 - On the nfs share create a two directories named "nfsuser" and "nfsuser1" which are owned by nfsuser and nfsuser1 respectively. Create two files in those directories. Eg, if the nfs share is /nfs, then we will have /nfs/nfsuser/a and /nfs/nfsuser1/a. - Mount the share on the client. [root@nfsclient ~]# grep nfs4 /proc/mounts nfsserver.example.com:/ /mnt nfs4 rw,vers=4,rsize=32768,wsize=32768,hard,intr,proto=tcp,timeo=600,retrans=3,sec=krb5i,addr=dhcp210-136.gsslab.pnq.redhat.com 0 0 - On one console do "su - nfsuser" and on another root console, do "su - nfsuser1". - Get a ticket valid for 1 minute for nfsuer. [nfsuser@nfsclient ~]$ kinit -l 1m Password for nfsuser: - Read from nfs share. [nfsuser@nfsclient ~]$ sleep 10000 < /mnt/nfsuser/a & [1] 19341 - Immediately, on the other console for nfsuser1, get a ticket which is valid for one day. [nfsuser1@nfsclient ~]$ kinit nfsuser1 Password for nfsuser1: - Make sure that you can read the below file without any problems. [nfsuser1@nfsclient ~]$ cat /mnt/nfsuser1/a - Wait for five minutes or still the nfsuser's credentials expire. [nfsuser1@nfsclient ~]$ sleep 300 - Then try to read the file again. [nfsuser1@nfsclient ~]$ cat /mnt/nfsuser1/a [it hangs indefinitely] Re-assigning this to kernel instead since the problem appears to be with the nfs client code. The upstream patch which fixes the issue was identified following a git bisect.
commit a2b2bb8822c78806930bbb4d4c5bb3ae69648fd0
Author: Trond Myklebust <Trond.Myklebust>
Date: Tue Apr 8 16:02:17 2008 -0400
NFSv4: Attempt to use machine credentials in SETCLIENTID calls
This need the following patch which adds cl_machine_cred to struct nfs_client and on first glance, any changes to this struct appears to break KABI
commit 7c67db3a8a98045744f06fcd6d8f476d9df0ba5c
Author: Trond Myklebust <Trond.Myklebust>
Date: Mon Apr 7 20:50:11 2008 -0400
NFSv4: Reintroduce machine creds
We need to try to ensure that we always use the same credentials whenever
we re-establish the clientid on the server. If not, the server won't
recognise that we're the same client, and so may not allow us to recover
state.
Signed-off-by: Trond Myklebust <Trond.Myklebust>
This request was evaluated by Red Hat Product Management for inclusion in Red Hat Enterprise Linux 5.7 and Red Hat does not plan to fix this issue the currently developed update. Contact your manager or support representative in case you need to escalate this bug. Created attachment 525636 [details] The backport of the first patch (commit 7c67db3a) in Comment 4 Created attachment 525638 [details] The backport of the second patch (commit a2b2bb88) in Comment 4 Created attachment 525791 [details] he backport of the first patch (commit 7c67db3a) in Comment 4 (kABI correct) Created attachment 525871 [details] The backport of the first patch (commit 7c67db3a) in Comment 4 (kABI corrected) (In reply to comment #4) > The upstream patch which fixes the issue was identified following a git bisect. > > commit a2b2bb8822c78806930bbb4d4c5bb3ae69648fd0 > Author: Trond Myklebust <Trond.Myklebust> > Date: Tue Apr 8 16:02:17 2008 -0400 > > NFSv4: Attempt to use machine credentials in SETCLIENTID calls > > This need the following patch which adds cl_machine_cred to struct nfs_client > and on first glance, any changes to this struct appears to break KABI > > commit 7c67db3a8a98045744f06fcd6d8f476d9df0ba5c > Author: Trond Myklebust <Trond.Myklebust> > Date: Mon Apr 7 20:50:11 2008 -0400 > > NFSv4: Reintroduce machine creds > > We need to try to ensure that we always use the same credentials whenever > we re-establish the clientid on the server. If not, the server won't > recognise that we're the same client, and so may not allow us to recover > state. > > Signed-off-by: Trond Myklebust <Trond.Myklebust> Unfortunately pulling in these patches are not that straightforward. The are depended on a fairly complicated infrastructure that does not exist in RHEL5. So I'm thinking we are going to have to live with what exists today... (In reply to comment #6) > This request was evaluated by Red Hat Product Management for inclusion in Red > Hat Enterprise Linux 5.7 and Red Hat does not plan to fix this issue the > currently developed update. > > Contact your manager or support representative in case you need to escalate > this bug. Hi there, I can re-produce the above error in Red Hat Enterprise Linux 5.7 ... (In reply to comment #6) > This request was evaluated by Red Hat Product Management for inclusion in Red > Hat Enterprise Linux 5.7 and Red Hat does not plan to fix this issue the > currently developed update. > > Contact your manager or support representative in case you need to escalate > this bug. Hi there, I can re-produce the above error in Red Hat Enterprise Linux 5.7 ... |