Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Chuck Lever III <chuck.lever@oracle.com>
To:     Neil Brown <neilb@suse.de>
CC:     Bruce Fields <bfields@fieldses.org>,
        Linux NFS Mailing List <linux-nfs@vger.kernel.org>,
        "Steinar H. Gunderson" <steinar+kernel@gunderson.no>
Subject: Re: [PATCH] SUNRPC: improve error response to over-size gss
 credential
Thread-Topic: [PATCH] SUNRPC: improve error response to over-size gss
 credential
Thread-Index: AQHXn4llB4UL3nuggEqDYctWgZidQauSl0YA
Date:   Fri, 3 Sep 2021 17:43:17 +0000
Message-ID: <09190612-156D-4ADD-ADFF-19FBA6F2F2FC@oracle.com>
References: <163053903731.24419.4079441567942239288@noble.neil.brown.name>
In-Reply-To: <163053903731.24419.4079441567942239288@noble.neil.brown.name>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?IsjOVAzsRwlMDsljwbsQxSE/YBFzE5aBE6mMybtAZ6rAzSPrqLi6zHw7fbwb?=
 =?us-ascii?Q?3f2GaTzZVtMX4lFawAP+ByhkgV8modLpWXax2Z1qxUmHKccwNczHHzduHsvw?=
 =?us-ascii?Q?Xp8ZOSQ+bbu3quioO1/d3T1SWZgdSuDroiGA5UjFm1FTXK/I9gX5UcAmboQN?=
 =?us-ascii?Q?3Z5JmkyEiVUmdHsybJWurPEJiYOrs9O9FrFiMGIZSBRQzKph3U60LxcbDsfB?=
 =?us-ascii?Q?6otixizZKaBbTYP2qAXQ29aHYVsku0SLx72RTnJZA/B1F1uJu3jiI6sAKwaZ?=
 =?us-ascii?Q?TWhKGwuRg59s/YEZhjYP8vlBCzTGdtDnb+R7SacxzI6Ykq549y2ccWQu2rRW?=
 =?us-ascii?Q?epxathIfLcfKxNQeOVvxzE8l0kejF3/7/aDen0KvmKiWWi5HJLbHyYpuCwII?=
 =?us-ascii?Q?IO1Oy2+DLEpNwUiH8JR8EEKp5ElMkCBwAGzZidkqN7wabqAP/jVzySLIa7E8?=
 =?us-ascii?Q?GG6vDca6qlF7CjfxFqaIfr4vYOJrNnUTRFQ5rN9jpC4R6W4zvOMDhq5yXz8P?=
 =?us-ascii?Q?qdKaE9hmMTApgOEcxqtLRIAF0EYPBLDdSyuw+AQJMOmkdeeoeKaggzIflfTA?=
 =?us-ascii?Q?BS/D2UesYyU6LxpqQsFnirs3/bQXkRxKf+Pc1W9XfqSf+46DyU8iFlDAJtBV?=
 =?us-ascii?Q?Oq2HTBqgYv0Ua+nwgPafdiYZIQbGHDdJ2wUYXLWVG4yX4b/xfpZ/FHUQmgxj?=
 =?us-ascii?Q?5CvaL5IJo/k8/VXnf7FyzEzMx670Y2NSlVax0QZlJxNlsu9sEBIc9HR7RdH3?=
 =?us-ascii?Q?8PW1+evlzI6RJUIqFD1qSFM9+V8U1o0EPNkWSOL/4vlzlPdxAUqm0rIzoaI4?=
 =?us-ascii?Q?GZkGX6GojUN0wjl7ERESxndwXtsh+DjBKeS3y4fvFbEODquNB6EvLPFkc02/?=
 =?us-ascii?Q?hhV+BIz0BlMMW7NOO31HXuv/Ula2RDhuCbon98SjwAFp+GxQD+XKvRBE0lQY?=
 =?us-ascii?Q?aw/KM8zCnUUC7UIEuBlRrDpz9oLvyi3sXmqmYHKqqSrpnMac9wjbdgqetVGy?=
 =?us-ascii?Q?1wZuB+sp50b1wduKKe6FiDC3JFvavNdtfVtu5YHctssYOP6k2n260picYPsV?=
 =?us-ascii?Q?y3Jg0mVpMAZ3qIGAMtG75nQJqCkYoj/JJie88chqMheJMfZVxpViKZZ52ovH?=
 =?us-ascii?Q?CmW3pZb1q5JzrSnSYt/XMZ1X9aDkjZ7clf9E+1PdqtoRHf0W8tBrig+KFzbY?=
 =?us-ascii?Q?bucKfH9MQybY7CDfuhqZrRx5nmWRoZ8cfyUZ5NfrrfRNabEqPeMQZ4sHibHG?=
 =?us-ascii?Q?rC3njyauMFrthkPrOBpe8SMtWU7N03/pK6NTZ+yskz4So1xEyWBPl3f519sF?=
 =?us-ascii?Q?5PcgiGChbqk571+jZBGrJpqT?=
x-ms-exchange-transport-forked: True
Content-Type: text/plain; charset="us-ascii"
Content-ID: <933B2F6DC8A5D84EA744F9D47D67ED1A@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: SJ0PR10MB4688.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 57850931-6461-488e-9a7d-08d96f025037
X-MS-Exchange-CrossTenant-originalarrivaltime: 03 Sep 2021 17:43:17.5537
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: QYK3BXcFruXiIEALGGC39Iv+3JTc7SMAV4mNPiskSF+CD3iK6vSq6kmZ9PDMR1syLTTwPtiIl19RAZGOk4yjrg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR10MB4258
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10096 signatures=668682
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 phishscore=0 suspectscore=0
 malwarescore=0 mlxscore=0 mlxlogscore=999 bulkscore=0 adultscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2108310000
 definitions=main-2109030104
X-Proofpoint-ORIG-GUID: oAmItlkDWms4tUiaMsuVcuR_mQB5vJCf
X-Proofpoint-GUID: oAmItlkDWms4tUiaMsuVcuR_mQB5vJCf
Precedence: bulk
List-ID: <linux-nfs.vger.kernel.org>
X-Mailing-List: linux-nfs@vger.kernel.org


> On Sep 1, 2021, at 7:30 PM, NeilBrown <neilb@suse.de> wrote:
>=20
>=20
> When the NFS server receives a large gss (kerberos) credential and tries
> to pass it up to rpc.svcgssd (which is deprecated), it triggers an
> infinite loop in cache_read().
>=20
> cache_request() always returns -EAGAIN, and this causes a "goto again".
>=20
> This patch:
> - changes the error to -E2BIG to avoid the infinite loop, and
> - generates a WARN_ONCE when rsi_request first sees an over-sized
>   credential.  The warning suggests switching to gssproxy.
>=20
> Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D196583
> Signed-off-by: NeilBrown <neilb@suse.de>

Thanks, Neil, I've queued this up for nfsd-5.15-1.


> ---
> net/sunrpc/auth_gss/svcauth_gss.c | 2 ++
> net/sunrpc/cache.c                | 2 +-
> 2 files changed, 3 insertions(+), 1 deletion(-)
>=20
> diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svca=
uth_gss.c
> index a81be45f40d9..e738c0182f09 100644
> --- a/net/sunrpc/auth_gss/svcauth_gss.c
> +++ b/net/sunrpc/auth_gss/svcauth_gss.c
> @@ -194,6 +194,8 @@ static void rsi_request(struct cache_detail *cd,
> 	qword_addhex(bpp, blen, rsii->in_handle.data, rsii->in_handle.len);
> 	qword_addhex(bpp, blen, rsii->in_token.data, rsii->in_token.len);
> 	(*bpp)[-1] =3D '\n';
> +	WARN_ONCE(*blen < 0,
> +		  "RPCSEC/GSS credential too large - please use gssproxy\n");
> }
>=20
> static int rsi_parse(struct cache_detail *cd,
> diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
> index 1a2c1c44bb00..59641803472c 100644
> --- a/net/sunrpc/cache.c
> +++ b/net/sunrpc/cache.c
> @@ -803,7 +803,7 @@ static int cache_request(struct cache_detail *detail,
>=20
> 	detail->cache_request(detail, crq->item, &bp, &len);
> 	if (len < 0)
> -		return -EAGAIN;
> +		return -E2BIG;
> 	return PAGE_SIZE - len;
> }
>=20
> --=20
> 2.32.0
>=20

--
Chuck Lever