ecryptfs fails to load block cipher on ppc64el

[Colin Ian King]

Specifically, this is not an ecryptfs issue. ecryptfs attempts to load the CBC AES block cipher and the ppc64el specific vmx_crypto crypto driver gets loaded. However, this is using the older blkcipher API rather than the newer skcipher API as introduced by the following commit in 4.10:

commit 79c65d179a40e145287e59b33dc782a7c4bf0986
Author: Herbert Xu <email address hidden>
Date: Tue Nov 22 20:08:39 2016 +0800

    crypto: cbc - Convert to skcipher

    This patch converts cbc over to the skcipher interface. It also
    rearranges the code to allow it to be reused by drivers.

We see the following error:

Feb 20 16:57:53 gulpin kernel: Failed to allocate transformation for 'cbc(aes)': -2
Feb 20 16:57:53 gulpin kernel: ecryptfs_init_crypt_ctx: cryptfs: init_crypt_ctx(): Error initializing cipher [cbc(aes)]
Feb 20 16:57:53 gulpin kernel: ecryptfs_new_file_context: Error initializing cryptographic context for cipher [aes]: rc = [-2]
Feb 20 16:57:53 gulpin kernel: ecryptfs_initialize_file: Error creating new file context; rc = [-2]
Feb 20 16:57:53 gulpin kernel: Failed to allocate transformation for 'cbc(aes)': -2

Loading the software based cbc crypto before starting ecryptfs rather than the optimized vmx_crypto allows ecryptfs to run correctly.

So, this core issue is that we need vmx_crypto updated to the newer crypto API to resolve this issue

[Brad Figg (brad-figg)]

This bug is missing log files that will aid in diagnosing the problem. From a terminal window please run:

apport-collect 1666483

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

[Marcelo Cerri (mhcerri)]

This probably affects all the blkciphers impĺemented by the driver.

[Marcelo Cerri (mhcerri)]

The best alternative is to blacklist the vmx-crypto driver while the module is not converted to the new skcipher API.

The module will fail while allocating several of its algorithms and it might cause errors in other subsystems that uses the crypto API.

[Tim Gardner (timg-tpi)]

UBUNTU: [Config] CONFIG_CRYPTO_DEV_VMX=n

We need to revisit this once we have some input from upstream.

[Paulo Flabiano Smorigo (pfsmorigo)]

I sent the fixes to lkml. I will update here when they get it upstream.

[Colin Ian King (colin-king)]

Thanks for the fast turnaround Paulo!

[Paulo Flabiano Smorigo (pfsmorigo)]

https://git.kernel.org/cgit/linux/kernel/git/herbert/crypto-2.6.git/commit/?id=c96d0a1c47abd5c4fa544dcedb5fac4d020ac58b
https://git.kernel.org/cgit/linux/kernel/git/herbert/crypto-2.6.git/commit/?id=5839f555fa576be57371686265206398d9ea1480

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 4.10.0-11.13

---------------
linux (4.10.0-11.13) zesty; urgency=low

  [ Tim Gardner ]

  * Release Tracking Bug
    - LP: #1669127

  * linux-tools-common should Depends: lsb-release (LP: #1667571)
    - [Config] linux-tools-common depends on lsb-release

  * Ubuntu (Zesty): When we miss LSI/INTx interrupts on slot, message is too
    imprecise (LP: #1668382)
    - of/irq: improve error report on irq discovery process failure

  * Zesty update to v4.10.1 stable release (LP: #1668993)
    - ptr_ring: fix race conditions when resizing
    - ip: fix IP_CHECKSUM handling
    - net: socket: fix recvmmsg not returning error from sock_error
    - tty: serial: msm: Fix module autoload
    - USB: serial: mos7840: fix another NULL-deref at open
    - USB: serial: cp210x: add new IDs for GE Bx50v3 boards
    - USB: serial: ftdi_sio: fix modem-status error handling
    - USB: serial: ftdi_sio: fix extreme low-latency setting
    - USB: serial: ftdi_sio: fix line-status over-reporting
    - USB: serial: spcp8x5: fix modem-status handling
    - USB: serial: opticon: fix CTS retrieval at open
    - USB: serial: ark3116: fix register-accessor error handling
    - USB: serial: console: fix uninitialised spinlock
    - x86/platform/goldfish: Prevent unconditional loading
    - goldfish: Sanitize the broken interrupt handler
    - netfilter: nf_ct_helper: warn when not applying default helper assignment
    - ACPICA: Linuxize: Restore and fix Intel compiler build
    - block: fix double-free in the failure path of cgwb_bdi_init()
    - rtlwifi: rtl_usb: Fix for URB leaking when doing ifconfig up/down
    - xfs: clear delalloc and cache on buffered write failure
    - Linux 4.10.1

  * [UBUNTU Zesty] mlx5 - Improve OVS offload driver (LP: #1668019)
    - net/sched: cls_flower: Disallow duplicate internal elements
    - net/sched: cls_flower: Properly handle classifier flags dumping
    - net/sched: cls_matchall: Dump the classifier flags
    - net/sched: Reflect HW offload status
    - net/sched: cls_flower: Reflect HW offload status
    - net/sched: cls_matchall: Reflect HW offloading status
    - net/sched: cls_u32: Reflect HW offload status
    - net/sched: cls_bpf: Reflect HW offload status
    - net/mlx5: Push min-inline mode resolution helper into the core
    - IB/mlx5: Enable Eth VFs to query their min-inline value for user-space
    - net/mlx5: Use exact encap header size for the FW input buffer
    - net/mlx5e: Add TC offloads matching on IPv6 encapsulation headers
    - net/mlx5e: TC ipv4 tunnel encap offload cosmetic changes
    - net/mlx5e: Use the full tunnel key info for encapsulation offload house- keeping
    - net/mlx5e: Maximize ip tunnel key usage on the TC offloading path
    - net/mlx5e: Support SRIOV TC encapsulation offloads for IPv6 tunnels
    - net/mlx5: E-Switch, Enlarge the FDB size for the switchdev mode
    - net/mlx5: Fix static checker warnings

  * [Hyper-V] Ubuntu 14.04.2 LTS Generation 2 SCSI Errors on VSS Based Backups
    (LP: #1470250)
    - SAUCE: Tools: hv: vss: Thaw the filesystem and continue after freeze fails

  * Ubuntu17.04: Need more patches for aacraid to bring up Bost...