Re: [PATCH] sunrpc: treat empty auth.unix.gid replies as negative entries

["Chuck Lever" <cel@kernel.org>]

On Fri, Aug 14, 2026, at 1:25 PM, Ameer Hamza wrote:
> When rpc.mountd cannot resolve a uid (getpwuid() or getgrouplist()
> failure, e.g. while winbind or sssd is briefly unreachable), it
> answers the auth.unix.gid upcall with zero groups. unix_gid_parse()
> installs that as a valid positive entry, and svcauth_unix_set_client()
> then replaces the credential's group list with the empty one on
> every request, RPCSEC_GSS included via svcauth_gss_set_client().
> One failed lookup strips that uid of all supplementary groups on
> every export for up to mountd's configured TTL (30 minutes by
> default), long after the NSS backend has recovered.
>
> mountd cannot send an empty list for a successful lookup, since
> getgrouplist(3) always includes at least the user's primary group,
> so a zero-group reply can only mean the lookup failed. Record it as
> a negative entry: unix_gid_find() then returns -ENOENT and
> svcauth_unix_set_client() keeps the groups the RPC credential
> already carries. This is the fallback that
> commit 3fc605a2aa38 ("[PATCH] knfsd: allow the server to provide a
> gid list when using AUTH_UNIX authentication") promised when no
> answer is available, and the same state try_to_negate_entry()
> already creates when no listener holds the channel open.
>
> Fixes: 3fc605a2aa38 ("[PATCH] knfsd: allow the server to provide a gid 
> list when using AUTH_UNIX authentication")
> Assisted-by: Claude:claude-fable-5
> Signed-off-by: Ameer Hamza <ameer.hamza@truenas.com>

Looks like the same bug exists for the new mountd netlink
mechanism. Since that instance of the bug arrived in a
different commit, that fix needs to be a separate patch
with its own Fixes: tag.

Can you make this a two-patch series?


-- 
Chuck Lever