Received-SPF: pass (google.com: best guess record for domain of linux-nfs-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Content-Type: text/plain;
        charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.11\))
Subject: Re: Regression in 5.1.20: Reading long directory fails
From:   Chuck Lever <chuck.lever@oracle.com>
In-Reply-To: <9c3483e089986fa9f5e8af8ea9e552f4313ecd6a.camel@hammerspace.com>
Date:   Sun, 8 Sep 2019 12:51:18 -0400
Cc:     "tibbs@math.uh.edu" <tibbs@math.uh.edu>,
        Bruce Fields <bfields@fieldses.org>,
        "linux@stwm.de" <linux@stwm.de>,
        Linux NFS Mailing List <linux-nfs@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "km@cm4all.com" <km@cm4all.com>
Content-Transfer-Encoding: quoted-printable
Message-Id: <87C8F695-2729-4A65-9738-2E651A344BA7@oracle.com>
References: <ufak1bhyuew.fsf@epithumia.math.uh.edu>
 <4418877.15LTP4gqqJ@stwm.de> <ufapnkhqjwm.fsf@epithumia.math.uh.edu>
 <4198657.JbNDGbLXiX@h2o.as.studentenwerk.mhn.de>
 <ufad0ggrfrk.fsf@epithumia.math.uh.edu> <20190906144837.GD17204@fieldses.org>
 <ufapnkdw3s3.fsf@epithumia.math.uh.edu>
 <75F810C6-E99E-40C3-B5E1-34BA2CC42773@oracle.com>
 <A862CFCD-76A2-4373-8F44-F156DB38E6A5@redhat.com>
 <1ebf86cff330eb15c02249f0dac415a8aff99f49.camel@hammerspace.com>
 <3B2EEB3C-3305-4A50-A55B-51093A985284@oracle.com>
 <9c3483e089986fa9f5e8af8ea9e552f4313ecd6a.camel@hammerspace.com>
To:     Trond Myklebust <trondmy@hammerspace.com>,
        "bcodding@redhat.com" <bcodding@redhat.com>
Sender: linux-nfs-owner@vger.kernel.org
Precedence: bulk


> On Sep 8, 2019, at 12:47 PM, Trond Myklebust <trondmy@hammerspace.com> =
wrote:
>=20
> On Sun, 2019-09-08 at 11:48 -0400, Chuck Lever wrote:
>>> On Sep 8, 2019, at 11:19 AM, Trond Myklebust <
>>> trondmy@hammerspace.com> wrote:
>>>=20
>>> On Sun, 2019-09-08 at 07:39 -0400, Benjamin Coddington wrote:
>>>> On 6 Sep 2019, at 16:50, Chuck Lever wrote:
>>>>=20
>>>>>> On Sep 6, 2019, at 4:47 PM, Jason L Tibbitts III <
>>>>>> tibbs@math.uh.edu>=20
>>>>>> wrote:
>>>>>>=20
>>>>>>>>>>> "JBF" =3D=3D J Bruce Fields <bfields@fieldses.org>
>>>>>>>>>>> writes:
>>>>>>=20
>>>>>> JBF> Those readdir changes were client-side, right?  Based on
>>>>>> that=20
>>>>>> I'd
>>>>>> JBF> been assuming a client bug, but maybe it'd be worth
>>>>>> getting
>>>>>> a=20
>>>>>> full
>>>>>> JBF> packet capture of the readdir reply to make sure it's
>>>>>> legit.
>>>>>>=20
>>>>>> I have been working with bcodding on IRC for the past couple
>>>>>> of
>>>>>> days=20
>>>>>> on
>>>>>> this.  Fortunately I was able to come up with way to fill up
>>>>>> a=20
>>>>>> directory
>>>>>> in such a way that it will fail with certainty and as a bonus
>>>>>> doesn't
>>>>>> include any user data so I can feel OK about sharing packet
>>>>>> captures.=20
>>>>>> I
>>>>>> have a capture alongside a kernel trace of the problematic
>>>>>> operation=20
>>>>>> in
>>>>>> https://www.math.uh.edu/~tibbs/nfs/.  Not that I can
>>>>>> particularly=20
>>>>>> tell
>>>>>> anything useful from that, but bcodding says that it seems to
>>>>>> point=20
>>>>>> to
>>>>>> some issue in sunrpc.
>>>>>>=20
>>>>>> And because I can easily reproduce this and I was able to do
>>>>>> a=20
>>>>>> bisect:
>>>>>>=20
>>>>>> 2c94b8eca1a26cd46010d6e73a23da5f2e93a19d is the first bad
>>>>>> commit
>>>>>> commit 2c94b8eca1a26cd46010d6e73a23da5f2e93a19d
>>>>>> Author: Chuck Lever <chuck.lever@oracle.com>
>>>>>> Date:   Mon Feb 11 11:25:41 2019 -0500
>>>>>>=20
>>>>>>  SUNRPC: Use au_rslack when computing reply buffer size
>>>>>>=20
>>>>>>  au_rslack is significantly smaller than (au_cslack << 2).
>>>>>> Using
>>>>>>  that value results in smaller receive buffers. In some
>>>>>> cases
>>>>>> this
>>>>>>  eliminates an extra segment in Reply chunks (RPC/RDMA).
>>>>>>=20
>>>>>>  Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
>>>>>>  Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
>>>>>>=20
>>>>>> :040000 040000 d4d1ce2fbe0035c5bd9df976b8c448df85dcb505=20
>>>>>> 7011a792dfe72ff9cd70d66e45d353f3d7817e3e M      net
>>>>>>=20
>>>>>> But of course, I can't say whether this is the actual bad
>>>>>> commit
>>>>>> or
>>>>>> whether it just introduced a behavior change which alters
>>>>>> the=20
>>>>>> conditions
>>>>>> under which the problem appears.
>>>>>=20
>>>>> The first place I'd start looking is the XDR constants at the
>>>>> head
>>>>> of=20
>>>>> fs/nfs/nfs4xdr.c
>>>>> having to do with READDIR.
>>>>>=20
>>>>> The report of behavior changes with the use of krb5p also makes
>>>>> this=20
>>>>> commit plausible.
>>>>=20
>>>> After sprinkling the printk's, we're coming up one word short in
>>>> the=20
>>>> receive
>>>> buffer.  I think we're not accounting for the xdr pad of buf-
>>>>> pages
>>>> for=20
>>>> NFS4
>>>> readdir -- but I need to check the RFCs.  Anyone know if v4
>>>> READDIR=20
>>>> results
>>>> have to be aligned?
>>>>=20
>>>> Also need to check just why krb5i is the only auth that cares..
>>>>=20
>>>=20
>>> I'm not seeing that. If you look at commit 02ef04e432ba, you'll see
>>> that Chuck did add a 'padding term' to decode_readdir_maxsz in the
>>> NFSv4 case.
>>> The other thing to remember is that a readdir 'dirlist4' entry is
>>> always word aligned (irrespective of the length of the filename),
>>> so
>>> there is no padding that needs to be taken into account.
>>>=20
>>> I think we probably rather want to look at how auth->au_ralign is
>>> being
>>> calculated for the case of krb5i. I'm really not understanding why
>>> auth->au_ralign should not take into account the presence of the
>>> mic.
>>> Chuck?
>>=20
>> I'm looking at gss_unwrap_resp_integ():
>>=20
>> 1971         auth->au_rslack =3D auth->au_verfsize + 2 + 1 +
>> XDR_QUADLEN(mic.len);
>> 1972         auth->au_ralign =3D auth->au_verfsize + 2;
>>=20
>> au_ralign now sets the alignment of the _start_ of the RPC message
>> body.
>> The MIC comes _after_ the RPC message body for krb5i.
>>=20
>> If Ben is off by one quad, that's not the MIC, which is typically 32
>> octets,
>> isn't it?
>>=20
>> Maybe some variable-length data item in the returned file attributes
>> is missing
>> an XDR pad.
>=20
> The only two pieces of variable length data in the readdir payload are
> the file name and the filehandle data. Those might present a problem
> when encoding on the server side, but not when decoding on the client
> side, since they are embedded in the dirlist4 (which, as I said, is
> automatically aligned).

The next thing I'd try, then, is to match the Wireshark-dissected
READDIR4 reply that fails with the macros at the top of fs/nfs/nfs4xdr.c
and look for anything that is missing.


> Hmm... One thing that does bother me in both gss_unwrap_resp_integ()
> and gss_unwrap_resp_priv() is that if the seqno does not match, then =
we
> return EIO. What if we had to retransmit a request, but the server
> managed to squeeze off a reply to the first transmission?
> Note: it should be pretty easy to catch issues such as this, since we
> do have tracepoints for them. That said, it is pretty hard to imagine
> this being the problem here if the bug is always reproducible (since
> retransmissions typically are not).
>=20
> --=20
> Trond Myklebust
> Linux NFS client maintainer, Hammerspace
> trond.myklebust@hammerspace.com

--
Chuck Lever