Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
From:   "NeilBrown" <neilb@suse.de>
To:     "Nikita Yushchenko" <nikita.yushchenko@virtuozzo.com>
Cc:     "Petr Vorel" <pvorel@suse.cz>, linux-nfs@vger.kernel.org,
        "J. Bruce Fields" <bfields@fieldses.org>,
        "Chuck Lever" <chuck.lever@oracle.com>,
        "Trond Myklebust" <trond.myklebust@hammerspace.com>,
        "Anna Schumaker" <anna.schumaker@netapp.com>,
        "Steve Dickson" <SteveD@redhat.com>, ltp@lists.linux.it,
        kernel@openvz.org
Subject: Re: LTP nfslock01 test failing on NFS v3 (lockd: cannot monitor 10.0.0.2)
In-reply-to: <a35ebb8b-6e61-8445-cf19-285bf2f875ad@virtuozzo.com>
References: <YebcNQg0u5cU1QyQ@pevik>,
 <a35ebb8b-6e61-8445-cf19-285bf2f875ad@virtuozzo.com>
Date:   Wed, 19 Jan 2022 09:13:35 +1100
Message-id: <164254401568.24166.883582030601071761@noble.neil.brown.name>
Precedence: bulk

On Wed, 19 Jan 2022, Nikita Yushchenko wrote:
> 18.01.2022 18:26, Petr Vorel wrote:
> > Hi all,
> >=20
> > this is a test failure posted by Nikita Yushchenko [1]. LTP NFS test nfsl=
ock01
> > looks to be failing on NFS v3:
> >=20
> > "not unsharing /var makes AF_UNIX socket for host's rpcbind to become ava=
ilable
> > inside ltpns. Then, at nfs3 mount time, kernel creates an instance of loc=
kd for
> > ltpns, and ports for that instance leak to host's rpcbind and overwrite p=
orts
> > for lockd already active for root namespace. This breaks nfs3 file lockin=
g."
>=20
> What exactly happens is:
>=20
> Test runs 'mount' in non-root netns, trying to mount a directory from root =
netns of the same host via nfsv3
>=20
> (Part of) call chain inside the kernel
>=20
> nfs_try_get_tree()
>   nfs3_create_server()
>    nfs_create_server()
>     nfs_init_server()
>      nfs_start_lockd()
>       nlmclnt_init()
>        lockd_up()
>         svc_bind()
>          svc_rpcb_setup()
>           rpcb_create_local()
>=20
> ... and at this point it tries AF_UNIX connection to /var/run/rpcbind.sock
>=20
> AF_UNIX is not netns-aware.
> So it connects to host's rpcbind.
> And overwrites ports registered in host's rpcbind by lockd instance for roo=
t namespace. Since this=20
> point, lockd instance for root namespace becomes no longer accessible (it s=
till listens but nobody can=20
> learn the ports). Thus nfs locks don't work.
>=20
> I'm not sure what is the correct behavior here.
>=20
> Maybe rpcb_create_local() shall detect that it is not in root netns, and on=
ly try AF_INET connection to=20
> localhost in that case.

That would be simple and might be sensible.  IF changing the AF_UNIX
path to "/run/rpcbind.sock" isn't sufficient, then testing for the
root_ns is probably the best second option.

Thanks,
NeilBrown