From 7bc856dfaa104bf2bc26abd40b53dbf857c2d5bc Mon Sep 17 00:00:00 2001 From: Ameer Hamza Date: Sat, 15 Aug 2026 03:19:53 +0500 Subject: [PATCH] sunrpc: honor the netlink unix_gid NEGATIVE flag The unix_gid netlink upcall protocol has an explicit SUNRPC_A_UNIX_GID_NEGATIVE attribute for failed group lookups, and mountd sends it, but sunrpc_nl_parse_one_unix_gid() only allocates an empty group list for a flagged reply without propagating the flag into the entry, so it installs a valid positive entry with zero groups. Such an entry strips the uid of all supplementary groups until it is refreshed or expires: the same defect the previous patch fixes on the classic channel, on a transport that can say "lookup failed" explicitly. Set CACHE_NEGATIVE for flagged replies, as the netlink ip_map path already does for its negative flag. An empty GIDS list without the flag remains a positive entry. Fixes: 0850e8603cd7 ("sunrpc: add netlink upcall for the auth.unix.gid cache") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-fable-5 Signed-off-by: Ameer Hamza Link: https://patch.msgid.link/20260814221953.108837-3-ameer.hamza@truenas.com Signed-off-by: Chuck Lever --- net/sunrpc/svcauth_unix.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c index 1b5616a0b918..a68fe44d1f62 100644 --- a/net/sunrpc/svcauth_unix.c +++ b/net/sunrpc/svcauth_unix.c @@ -737,6 +737,8 @@ static int sunrpc_nl_parse_one_unix_gid(struct cache_detail *cd, boot.tv_sec; if (tb[SUNRPC_A_UNIX_GID_NEGATIVE]) { + /* failed lookup: keep the credential's own groups */ + set_bit(CACHE_NEGATIVE, &ug.h.flags); ug.gi = groups_alloc(0); if (!ug.gi) return -ENOMEM;