SUNRPC handle EKEYEXPIRED in call_refreshresult

Currently, when an RPCSEC_GSS context has expired or is non-existent
and the users (Kerberos) credentials have also expired or are non-existent,
the client receives the -EKEYEXPIRED error and tries to refresh the context
forever.  If an application is performing I/O, or other work against the share,
the application hangs, and the user is not prompted to refresh/establish their
credentials. This can result in a denial of service for other users.

Users are expected to manage their Kerberos credential lifetimes to mitigate
this issue.

Move the -EKEYEXPIRED handling into the RPC layer. Try tk_cred_retry number
of times to refresh the gss_context, and then return -EACCES to the application.

Signed-off-by: Andy Adamson <andros@netapp.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

6 files changed, 4 insertions, 88 deletions

diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c
index 69322096c325..70efb63b1e42 100644
--- a/fs/nfs/nfs3proc.c
+++ b/fs/nfs/nfs3proc.c
@@ -24,14 +24,14 @@
 
 #define NFSDBG_FACILITY         NFSDBG_PROC
 
-/* A wrapper to handle the EJUKEBOX and EKEYEXPIRED error messages */
+/* A wrapper to handle the EJUKEBOX error messages */
 static int
 nfs3_rpc_wrapper(struct rpc_clnt *clnt, struct rpc_message *msg, int flags)
 {
         int res;
         do {
                 res = rpc_call_sync(clnt, msg, flags);
-                if (res != -EJUKEBOX && res != -EKEYEXPIRED)
+                if (res != -EJUKEBOX)
                         break;
                 freezable_schedule_timeout_killable(NFS_JUKEBOX_RETRY_TIME);
                 res = -ERESTARTSYS;
@@ -44,7 +44,7 @@ nfs3_rpc_wrapper(struct rpc_clnt *clnt, struct rpc_message *msg, int flags)
 static int
 nfs3_async_handle_jukebox(struct rpc_task *task, struct inode *inode)
 {
-        if (task->tk_status != -EJUKEBOX && task->tk_status != -EKEYEXPIRED)
+        if (task->tk_status != -EJUKEBOX)
                 return 0;
         if (task->tk_status == -EJUKEBOX)
                 nfs_inc_stats(inode, NFSIOS_DELAY);
diff --git a/fs/nfs/nfs4filelayout.c b/fs/nfs/nfs4filelayout.c
index 1e42413fab8f..194c48410336 100644
--- a/fs/nfs/nfs4filelayout.c
+++ b/fs/nfs/nfs4filelayout.c
@@ -179,7 +179,6 @@ static int filelayout_async_handle_error(struct rpc_task *task,
                 break;
         case -NFS4ERR_DELAY:
         case -NFS4ERR_GRACE:
-        case -EKEYEXPIRED:
                 rpc_delay(task, FILELAYOUT_POLL_RETRY_MAX);
                 break;
         case -NFS4ERR_RETRY_UNCACHED_REP:
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index a4692e97bc19..b0963aeceeda 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -333,7 +333,6 @@ static int nfs4_handle_exception(struct nfs_server *server, int errorcode, struc
                         }
                 case -NFS4ERR_GRACE:
                 case -NFS4ERR_DELAY:
-                case -EKEYEXPIRED:
                         ret = nfs4_delay(server->client, &exception->timeout);
                         if (ret != 0)
                                 break;
@@ -1343,13 +1342,6 @@ int nfs4_open_delegation_recall(struct nfs_open_context *ctx, struct nfs4_state
                                 nfs_inode_find_state_and_recover(state->inode,
                                                 stateid);
                                 nfs4_schedule_stateid_recovery(server, state);
-                        case -EKEYEXPIRED:
-                                /*
-                                 * User RPCSEC_GSS context has expired.
-                                 * We cannot recover this stateid now, so
-                                 * skip it and allow recovery thread to
-                                 * proceed.
-                                 */
                         case -ENOMEM:
                                 err = 0;
                                 goto out;
@@ -3946,7 +3938,6 @@ nfs4_async_handle_error(struct rpc_task *task, const struct nfs_server *server,
                 case -NFS4ERR_DELAY:
                         nfs_inc_server_stats(server, NFSIOS_DELAY);
                 case -NFS4ERR_GRACE:
-                case -EKEYEXPIRED:
                         rpc_delay(task, NFS4_POLL_RETRY_MAX);
                         task->tk_status = 0;
                         return -EAGAIN;
@@ -4946,15 +4937,6 @@ int nfs4_lock_delegation_recall(struct nfs4_state *state, struct file_lock *fl)
                                 nfs4_schedule_stateid_recovery(server, state);
                                 err = 0;
                                 goto out;
-                        case -EKEYEXPIRED:
-                                /*
-                                 * User RPCSEC_GSS context has expired.
-                                 * We cannot recover this stateid now, so
-                                 * skip it and allow recovery thread to
-                                 * proceed.
-                                 */
-                                err = 0;
-                                goto out;
                         case -ENOMEM:
                         case -NFS4ERR_DENIED:
                                 /* kill_proc(fl->fl_pid, SIGLOST, 1); */
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index 78e90a80fc3a..8dcbd9a0367d 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1437,14 +1437,6 @@ restart:
                                 /* Mark the file as being 'closed' */
                                 state->state = 0;
                                 break;
-                        case -EKEYEXPIRED:
-                                /*
-                                 * User RPCSEC_GSS context has expired.
-                                 * We cannot recover this stateid now, so
-                                 * skip it and allow recovery thread to
-                                 * proceed.
-                                 */
-                                break;
                         case -NFS4ERR_ADMIN_REVOKED:
                         case -NFS4ERR_STALE_STATEID:
                         case -NFS4ERR_BAD_STATEID:
@@ -1597,14 +1589,6 @@ static void nfs4_state_start_reclaim_nograce(struct nfs_client *clp)
         nfs4_state_mark_reclaim_helper(clp, nfs4_state_mark_reclaim_nograce);
 }
 
-static void nfs4_warn_keyexpired(const char *s)
-{
-        printk_ratelimited(KERN_WARNING "Error: state manager"
-                        " encountered RPCSEC_GSS session"
-                        " expired against NFSv4 server %s.\n",
-                        s);
-}
-
 static int nfs4_recovery_handle_error(struct nfs_client *clp, int error)
 {
         switch (error) {
@@ -1638,10 +1622,6 @@ static int nfs4_recovery_handle_error(struct nfs_client *clp, int error)
                 case -NFS4ERR_CONN_NOT_BOUND_TO_SESSION:
                         set_bit(NFS4CLNT_BIND_CONN_TO_SESSION, &clp->cl_state);
                         break;
-                case -EKEYEXPIRED:
-                        /* Nothing we can do */
-                        nfs4_warn_keyexpired(clp->cl_hostname);
-                        break;
                 default:
                         dprintk("%s: failed to handle error %d for server %s\n",
                                         __func__, error, clp->cl_hostname);
@@ -1758,8 +1738,6 @@ static int nfs4_handle_reclaim_lease_error(struct nfs_client *clp, int status)
                 dprintk("%s: exit with error %d for server %s\n",
                                 __func__, -EPROTONOSUPPORT, clp->cl_hostname);
                 return -EPROTONOSUPPORT;
-        case -EKEYEXPIRED:
-                nfs4_warn_keyexpired(clp->cl_hostname);
         case -NFS4ERR_NOT_SAME: /* FixMe: implement recovery
                                  * in nfs4_exchange_id */
         default:
@@ -1912,7 +1890,6 @@ again:
                 break;
 
         case -EKEYEXPIRED:
-                nfs4_warn_keyexpired(clp->cl_hostname);
         case -NFS4ERR_NOT_SAME: /* FixMe: implement recovery
                                  * in nfs4_exchange_id */
                 status = -EKEYEXPIRED;
diff --git a/fs/nfs/proc.c b/fs/nfs/proc.c
index 50a88c3546ed..f084dac948e1 100644
--- a/fs/nfs/proc.c
+++ b/fs/nfs/proc.c
@@ -47,39 +47,6 @@
 #define NFSDBG_FACILITY         NFSDBG_PROC
 
 /*
- * wrapper to handle the -EKEYEXPIRED error message. This should generally
- * only happen if using krb5 auth and a user's TGT expires. NFSv2 doesn't
- * support the NFSERR_JUKEBOX error code, but we handle this situation in the
- * same way that we handle that error with NFSv3.
- */
-static int
-nfs_rpc_wrapper(struct rpc_clnt *clnt, struct rpc_message *msg, int flags)
-{
-        int res;
-        do {
-                res = rpc_call_sync(clnt, msg, flags);
-                if (res != -EKEYEXPIRED)
-                        break;
-                freezable_schedule_timeout_killable(NFS_JUKEBOX_RETRY_TIME);
-                res = -ERESTARTSYS;
-        } while (!fatal_signal_pending(current));
-        return res;
-}
-
-#define rpc_call_sync(clnt, msg, flags) nfs_rpc_wrapper(clnt, msg, flags)
-
-static int
-nfs_async_handle_expired_key(struct rpc_task *task)
-{
-        if (task->tk_status != -EKEYEXPIRED)
-                return 0;
-        task->tk_status = 0;
-        rpc_restart_call(task);
-        rpc_delay(task, NFS_JUKEBOX_RETRY_TIME);
-        return 1;
-}
-
-/*
  * Bare-bones access to getattr: this is for nfs_read_super.
  */
 static int
@@ -364,8 +331,6 @@ static void nfs_proc_unlink_rpc_prepare(struct rpc_task *task, struct nfs_unlink
 
 static int nfs_proc_unlink_done(struct rpc_task *task, struct inode *dir)
 {
-        if (nfs_async_handle_expired_key(task))
-                return 0;
         nfs_mark_for_revalidate(dir);
         return 1;
 }
@@ -385,8 +350,6 @@ static int
 nfs_proc_rename_done(struct rpc_task *task, struct inode *old_dir,
                      struct inode *new_dir)
 {
-        if (nfs_async_handle_expired_key(task))
-                return 0;
         nfs_mark_for_revalidate(old_dir);
         nfs_mark_for_revalidate(new_dir);
         return 1;
@@ -642,9 +605,6 @@ static int nfs_read_done(struct rpc_task *task, struct nfs_read_data *data)
 {
         struct inode *inode = data->header->inode;
 
-        if (nfs_async_handle_expired_key(task))
-                return -EAGAIN;
-
         nfs_invalidate_atime(inode);
         if (task->tk_status >= 0) {
                 nfs_refresh_inode(inode, data->res.fattr);
@@ -671,9 +631,6 @@ static int nfs_write_done(struct rpc_task *task, struct nfs_write_data *data)
 {
         struct inode *inode = data->header->inode;
 
-        if (nfs_async_handle_expired_key(task))
-                return -EAGAIN;
-
         if (task->tk_status >= 0)
                 nfs_post_op_update_inode_force_wcc(inode, data->res.fattr);
         return 0;
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index c69e199b1082..55e174f2d02f 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -1381,6 +1381,7 @@ call_refreshresult(struct rpc_task *task)
                 return;
         case -ETIMEDOUT:
                 rpc_delay(task, 3*HZ);
+        case -EKEYEXPIRED:
         case -EAGAIN:
                 status = -EACCES;
                 if (!task->tk_cred_retry)