All of lore.kernel.org
 help / color / mirror / Atom feed
From: Wolfgang Walter <linux@stwm.de>
To: stable@vger.kernel.org
Cc: gregkh@linuxfoundation.org,
	Ben Hutchings <ben.hutchings@codethink.co.uk>,
	linux-kernel@vger.kernel.org
Subject: Re: NFS: regression in stable kernel 4.9.78 from 4.9.75
Date: Mon, 29 Jan 2018 14:42:49 +0100	[thread overview]
Message-ID: <3821612.ct3L5FXvrM@stwm.de> (raw)
In-Reply-To: <2316958.ApAh1ic5rg@stwm.de>

Hello!

Am Montag, 29. Januar 2018, 13:22:49 schrieb Wolfgang Walter:
> Hello,
> 
> after upgrading our nfs-server from  4.9.75 to 4.9.78 group permissions stop
> working (for clients). If you need group permissions to access a file or
> directory, sometimes access is granted, but rather often denied. Often
> access to the same object is denied within seconds after access was granted
> in an earlier access. user permissions work fine.
> 
> Downgrading to 4.9.75 fixes the issue.
> 
> We use kerberos.
> 
> Regards,

This seems to be fixed in 4.15 with commit 
1995266727fa8143897e89b55f5d3c79aa828420:


commit 1995266727fa8143897e89b55f5d3c79aa828420
Author: Ben Hutchings <ben.hutchings@codethink.co.uk>
Date:   Mon Jan 22 20:11:06 2018 +0000

    nfsd: auth: Fix gid sorting when rootsquash enabled
    
    Commit bdcf0a423ea1 ("kernel: make groups_sort calling a responsibility
    group_info allocators") appears to break nfsd rootsquash in a pretty
    major way.
    
    It adds a call to groups_sort() inside the loop that copies/squashes
    gids, which means the valid gids are sorted along with the following
    garbage.  The net result is that the highest numbered valid gids are
    replaced with any lower-valued garbage gids, possibly including 0.
    
    We should sort only once, after filling in all the gids.
    
    Fixes: bdcf0a423ea1 ("kernel: make groups_sort calling a responsibility 
...")
    Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
    Acked-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>


So this should be applied to stables 4.4, 4.9 and 4.14 (and others where 
bdcf0a423ea1 has been backported to).

Regards,
-- 
Wolfgang Walter
Studentenwerk München
Anstalt des öffentlichen Rechts

WARNING: multiple messages have this Message-ID (diff)
From: Wolfgang Walter <linux@stwm.de>
To: stable@vger.kernel.org
Cc: gregkh@linuxfoundation.org,
	Ben Hutchings <ben.hutchings@codethink.co.uk>,
	linux-kernel@vger.kernel.org
Subject: Re: NFS: regression in stable kernel 4.9.78 from 4.9.75
Date: Mon, 29 Jan 2018 14:42:49 +0100	[thread overview]
Message-ID: <3821612.ct3L5FXvrM@stwm.de> (raw)
In-Reply-To: <2316958.ApAh1ic5rg@stwm.de>

Hello!

Am Montag, 29. Januar 2018, 13:22:49 schrieb Wolfgang Walter:
> Hello,
> 
> after upgrading our nfs-server from  4.9.75 to 4.9.78 group permissions stop
> working (for clients). If you need group permissions to access a file or
> directory, sometimes access is granted, but rather often denied. Often
> access to the same object is denied within seconds after access was granted
> in an earlier access. user permissions work fine.
> 
> Downgrading to 4.9.75 fixes the issue.
> 
> We use kerberos.
> 
> Regards,

This seems to be fixed in 4.15 with commit 
1995266727fa8143897e89b55f5d3c79aa828420:


commit 1995266727fa8143897e89b55f5d3c79aa828420
Author: Ben Hutchings <ben.hutchings@codethink.co.uk>
Date:   Mon Jan 22 20:11:06 2018 +0000

    nfsd: auth: Fix gid sorting when rootsquash enabled
    
    Commit bdcf0a423ea1 ("kernel: make groups_sort calling a responsibility
    group_info allocators") appears to break nfsd rootsquash in a pretty
    major way.
    
    It adds a call to groups_sort() inside the loop that copies/squashes
    gids, which means the valid gids are sorted along with the following
    garbage.  The net result is that the highest numbered valid gids are
    replaced with any lower-valued garbage gids, possibly including 0.
    
    We should sort only once, after filling in all the gids.
    
    Fixes: bdcf0a423ea1 ("kernel: make groups_sort calling a responsibility 
...")
    Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
    Acked-by: J. Bruce Fields <bfields@redhat.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>


So this should be applied to stables 4.4, 4.9 and 4.14 (and others where 
bdcf0a423ea1 has been backported to).

Regards,
-- 
Wolfgang Walter
Studentenwerk M�nchen
Anstalt des �ffentlichen Rechts

  parent reply	other threads:[~2018-01-29 13:42 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-01-29 12:22 NFS: regression in stable kernel 4.9.78 from 4.9.75 Wolfgang Walter
2018-01-29 12:37 ` Greg KH
2018-01-29 13:42 ` Wolfgang Walter [this message]
2018-01-29 13:42   ` Wolfgang Walter
2018-01-29 13:54   ` Greg KH

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=3821612.ct3L5FXvrM@stwm.de \
    --to=linux@stwm.de \
    --cc=ben.hutchings@codethink.co.uk \
    --cc=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.