Received-SPF: pass (google.com: domain of linux-nfs-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Chuck Lever III <chuck.lever@oracle.com>
To:     Dai Ngo <dai.ngo@oracle.com>, Neil Brown <neilb@suse.de>
CC:     Linux NFS Mailing List <linux-nfs@vger.kernel.org>
Subject: Re: [PATCH] NFSD: callback request does not use correct credential
 for AUTH_SYS
Thread-Topic: [PATCH] NFSD: callback request does not use correct credential
 for AUTH_SYS
Thread-Index: AQHZZNetCma7323OEkqk2ZkGldRq468YIHMA
Date:   Sun, 2 Apr 2023 15:09:16 +0000
Message-ID: <CF4DFCD5-332D-4147-AA8A-F81FAB96AFA4@oracle.com>
References: <1680380528-22306-1-git-send-email-dai.ngo@oracle.com>
In-Reply-To: <1680380528-22306-1-git-send-email-dai.ngo@oracle.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?WRp4eHV6LRJlaJupjLLCcEAIem6holavGCFxAo1J+FwMzDIwch0D7ElYkzRu?=
 =?us-ascii?Q?N3ML5dSajiNzfnpyAJq3TSwnRkYIpHq1XM+9n1u6mTfyUpuNMgr/i5xeEiUk?=
 =?us-ascii?Q?LNFCIzn263vwO6j93i0zqmAt/ND3JAvhUQEPp6HreXa0cQnG3ksen+InBmaj?=
 =?us-ascii?Q?qZG9lmvIT3b3l1zRVPXwkaroUmtIfpdQLdzu5eAaq0nBrIkFYXhf6pKv+iC4?=
 =?us-ascii?Q?VRalMXuK5VsGFZGlft+K9JMakJ+KHkx+mMOnG1+e2Se1NQT9Rq12a21LcOQA?=
 =?us-ascii?Q?Q+MYMOsBYIBvhwfvUAYvJQbm4Rvw/aKaGmxockndDspINvqVfkMXfzQ0Z8j6?=
 =?us-ascii?Q?xz4bhOToPe+NHdQpRlr1fOimp79nETB1uhBoWxQ/RxGsvDQdTaBTRyCSbwOu?=
 =?us-ascii?Q?O4lfynqKdyy+/4SqA7IOsiDEY8P2nakmy+cQ5kQTDID02Frrkmq7alyu1vR/?=
 =?us-ascii?Q?09aMi5ZSKf5UNmPVf1zWcHI0Ugef4qj00PnvWRXt1MKtiOst/NmRS7ZS0MdO?=
 =?us-ascii?Q?JOODkfYLjH2Xux7aSRgT7NE7d6ELV+hxRRzvJhTUqRJR88HWbokjs1jxnQGT?=
 =?us-ascii?Q?hZu835JLt8Rb/oJ60zKn3ex6EbZC76iDEJ2b0acA000vZKHm1r/qGx75DQQl?=
 =?us-ascii?Q?dJfXbGsGe4LDifDBoDCvaJf5BzKvhgUeiiVI+1vbLtlFNEvVspuROCNpiC4D?=
 =?us-ascii?Q?frBA0wmP3tbni95Auo4/Bjht8esUqaFPOqXr1FB830iDcb+OpUFLgWBegAzh?=
 =?us-ascii?Q?3uAss6biT0qkbItWbxC2+2530zcBs4JjuREV9QCcX3DMZSnaJbZu7mb3jKzV?=
 =?us-ascii?Q?mMQtm29bMj1O39lq7JmBfMbKSwIvgpeqFx0+BUpaDuvFxFtT9tajUyBsLjYh?=
 =?us-ascii?Q?ESEI6BUUYr3bAaSuweARw0rjtW8Oz3M6IcgbWORXSS0GC3zO9HHF5FRK98bu?=
 =?us-ascii?Q?CzOKe0MH0BFEzhy8dY8IJA91px+oDw37urf1L7kuFgvJCbSkJtLDHOn0uJti?=
 =?us-ascii?Q?PbjT39ir+xCyhDnQ3kmHZKdRAiI+gN2wZC/QRIdH0487T2nQMjEnOa+HdlEw?=
 =?us-ascii?Q?6Cbk/g9lc1S1Zf4/eUnXyMn5njbmisOlCXFBTI47YC3JkFqgow3moZHwUiqk?=
 =?us-ascii?Q?fSa4cEmlm2i46xpn4n2HR+B7hWD9SgVIJ5y/s3G1PF5z1u+JsxfhNDrlnnvE?=
 =?us-ascii?Q?dawydCM/TyIUCL8OADOpesLFUBJY0ObhXe0FamOIFcj77hO30vHV+3jdFypd?=
 =?us-ascii?Q?TDKrSfsCoEn+ReTY489x1jLRColaFobKjpyGugBmAw5YqEUIDtESHr1hquCl?=
 =?us-ascii?Q?SLsRZYA0MXXyAneR/OwzHshCjNfiOKklnIa1YF2XFprLIfRURuvh+GiVCR66?=
 =?us-ascii?Q?qkNq3fmYPsdR2u2ZbbiQ3Upjq5Yj5XEdt7fhTlnrjrPaaKJLKU+9oXDlcTzT?=
 =?us-ascii?Q?zkf3jjUFIMoXBRHQP68ZRoalx5gBaDuun/4/GNwTC5zpXX5FfekejPVCEjPd?=
 =?us-ascii?Q?b9CNm71NN5d5OUXFxedb6YWHkSGYKiftyEBNkSfLMWI2ZShJMKzxJoYd0bYx?=
 =?us-ascii?Q?+p0G8oN5F/0/LWyBge/qH3S6rQ4ZogPa7i1Y0q4Ww3S1FCpK0TK8ZheI/aLi?=
 =?us-ascii?Q?Zw=3D=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-ID: <311CE5607A00AC45903D89E8CA6F24DC@namprd10.prod.outlook.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: o4aGuat45yIx50B7sat8gaGbldkbcTyB7lesaz6oIBp+ophGMynE7CnrU6nBiaOiEPatiot2A+rXiE3ZXFIzroAnAYwOTqK26bDOTwIawD7l8Osqts/Qhe61F7UNMEKXdLEghQyP9JUHvkr/g6V08Sky+O07UTGCXJ9d493tSbyRf3lmS9ujfLM4YcmoAySswsw5fNTBvuvjcr8T4rUhAXL3dwGms5/F2Ve6CwKpwlhRbVPeBOyObQDz0fH37sp/U5EfeSg8MEJSgvWehqNKmNiK8OxNB6wNbewBjCOs1ZMGy/Go5SLObKdcciSWzZRhFYbh+TTU96+zb3eutIbkb3aXyWD8yjh7kqgtHCCUu4ZpyS6vPfWDIyh42lIsPVxEfd7cD10TCvL55IAWyWD4fsCUr/8/7ZFVMRSJEXynYIMMWz8N/MjlM5OJt3aU66ybta9ux2+EdUk8tcRTPJA1j2eNuLHmpJBx3nG3AbBluBcdtHU0tuREE1FJmBaHk4XZgE4s/jxwIGylbRGmnRggMUEvOCxv3dijuEu5pAKOX9AXDb0t7E54X5rjt+CFNF8KV6HSmujx/WdBob9r7Rb76Rfck0tO5mex+XnK6jiSpTumwkOZH5LM6r2U661flwFIBKQ9ZyNnCOPIPTR1vRC0J06+4Y9fRbY9uoPB9JPVvnxdQbF3iZtlxtrc/BzMHTZBKoOB8ufWalPf16hcLwa7mVTp0wI2GyCZ7D2gp+AS9gWKJasmoOzbB9zrZsDVS4QRdNeFsfgDQkY0QdrmUpJu8A==
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: DS7PR10MB5134.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 753037bb-35f2-4fce-a18c-08db338c3a1f
X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Apr 2023 15:09:16.6416
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: m3E4UEIm69gAJrqrKC/bEi+WXrErLVVTuMjH5tbHE6caUUggH16ehhSrze2vk65EIX//70HjU79u6xlkMTPj4A==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO1PR10MB4433
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.254,Aquarius:18.0.942,Hydra:6.0.573,FMLib:17.11.170.22
 definitions=2023-03-31_07,2023-03-31_01,2023-02-09_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 adultscore=0
 phishscore=0 bulkscore=0 mlxscore=0 malwarescore=0 mlxlogscore=999
 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2303200000 definitions=main-2304020128
X-Proofpoint-ORIG-GUID: U5Yq5Cnmqz7LlNbB_DhJmwuu3xyDLGfG
X-Proofpoint-GUID: U5Yq5Cnmqz7LlNbB_DhJmwuu3xyDLGfG
X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
        DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H2,
        SPF_HELO_NONE,SPF_NONE autolearn=unavailable autolearn_force=no
        version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-nfs.vger.kernel.org>
X-Mailing-List: linux-nfs@vger.kernel.org


> On Apr 1, 2023, at 4:22 PM, Dai Ngo <dai.ngo@oracle.com> wrote:
>=20
> Currently callback request does not use the credential specified in
> CREATE_SESSION if the security flavor for the back channel is AUTH_SYS.
>=20
> Problem was discovered by pynfs 4.1 DELEG5 and DELEG7 test with error:
> DELEG5   st_delegation.testCBSecParms     : FAILURE
>           expected callback with uid, gid =3D=3D 17, 19, got 0, 0
>=20
> Signed-off-by: Dai Ngo <dai.ngo@oracle.com>

Does

Fixes: 8276c902bbe9 ("SUNRPC: remove uid and gid from struct auth_cred")

sound OK to everyone?


> ---
> fs/nfsd/nfs4callback.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>=20
> diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
> index 2a815f5a52c4..4039ffcf90ba 100644
> --- a/fs/nfsd/nfs4callback.c
> +++ b/fs/nfsd/nfs4callback.c
> @@ -946,8 +946,8 @@ static const struct cred *get_backchannel_cred(struct=
 nfs4_client *clp, struct r
> if (!kcred)
> return NULL;
>=20
> - kcred->uid =3D ses->se_cb_sec.uid;
> - kcred->gid =3D ses->se_cb_sec.gid;
> + kcred->fsuid =3D ses->se_cb_sec.uid;
> + kcred->fsgid =3D ses->se_cb_sec.gid;
> return kcred;
> }
> }
> --=20
> 2.9.5
>=20

--
Chuck Lever