Valid eCryptfs headers not found in file header region or xattr region

[starslights]

Hello,

I run kubuntu karmic 9.10 on x86 64 with ecryptfs but from a couple days , i have randomely and non stop many error in my logs.

2010-02-27 14:59:28 moon kernel [318860.426869] Valid eCryptfs headers not found in file header region or xattr region
2010-02-27 14:59:28 moon kernel [318860.426872] Either the lower file is not in a valid eCryptfs format, or the key could not be retrieved. Plaintext passthrough mode is not enabled; returning -EIO
2010-02-27 14:59:28 moon kernel [318860.459637] Valid eCryptfs headers not found in file header region or xattr region
2010-02-27 14:59:28 moon kernel [318860.459642] Either the lower file is not in a valid eCryptfs format, or the key could not be retrieved. Plaintext passthrough mode is not enabled; returning -EIO
2010-02-27 14:59:54 moon kernel [318886.793716] Valid eCryptfs headers not found in file header region or xattr region
2010-02-27 14:59:54 moon kernel [318886.793721] Either the lower file is not in a valid eCryptfs format, or the key could not be retrieved. Plaintext passthrough mode is not enabled; returning -EIO
2010-02-27 15:01:50 moon ntpd[30223] kernel time sync status change 6001
2010-02-27 15:01:58 moon iplist[9939] info: User defined signal 1 signal caught
2010-02-27 15:02:03 moon kernel [319015.993202] Valid eCryptfs headers not found in file header region or xattr region
2010-02-27 15:02:03 moon kernel [319015.993207] Either the lower file is not in a valid eCryptfs format, or the key could not be retrieved. Plaintext passthrough mode is not enabled; returning -EIO
2010-02-27 15:02:03 moon kernel [319016.004582] Valid eCryptfs headers not found in file header region or xattr region
2010-02-27 15:02:03 moon kernel [319016.004588] Either the lower file is not in a valid eCryptfs format, or the key could not be retrieved. Plaintext passthrough mode is not enabled; returning -EIO
2010-02-27 15:02:07 moon kernel [319019.595294] ecryptfs_read_lower: octets_read = [-4]; expected [4096]
2010-02-27 15:02:07 moon kernel [319019.595298] ecryptfs_read_and_validate_header_region: Error reading header region; rc = [-22]
2010-02-27 15:02:07 moon kernel [319019.605154] ecryptfs_read_lower: octets_read = [-4]; expected [4096]
2010-02-27 15:02:07 moon kernel [319019.605158] ecryptfs_read_and_validate_header_region: Error reading header region; rc = [-22]
2010-02-27 15:02:08 moon kernel [319020.989045] ecryptfs_read_lower: octets_read = [-4]; expected [4096]
2010-02-27 15:02:08 moon kernel [319020.989049] ecryptfs_read_and_validate_header_region: Error reading header region; rc = [-22]

Early was only a few times this message but now it come non-stop :/

I dunno if are the cause of a few error while can't write .temp files on the master HDD

So i better report it to be sure to provide more info as possible

ProblemType: Bug
Architecture: amd64
AudioDevicesInUse:
 USER PID ACCESS COMMAND
 /dev/snd/controlC0: moonlights 4221 F.... knotify4
                      moonlights 4264 F.... kmix
CRDA: Error: [Errno 2] Aucun fichier ou dossier de ce type
Card0.Amixer.info:
 Card hw:0 'Intel'/'HDA Intel at 0xf9ff8000 irq 22'
   Mixer name : 'Analog Devices AD1989B'
   Components : 'HDA:11d4989b,10438311,00100300'
   Controls : 48
   Simple ctrls : 27
DKDisksMonitorLog: Monitoring activity from the disks daemon. Press Ctrl+C to cancel.
Date: Sat Feb 27 15:03:25 2010
DistroRelease: Ubuntu 9.10
HibernationDevice: RESUME=UUID=83c95442-a3bb-41ea-9822-97768074dcbf
HotplugNewDevices:

HotplugNewMounts:

InstallationMedia: Kubuntu 9.10 "Karmic Koala" - Release amd64 (20091027)
MachineType: System manufacturer P5Q-E
NonfreeKernelModules: nvidia
Package: linux-image-2.6.31-20-generic 2.6.31-20.57
ProcCmdLine: BOOT_IMAGE=/boot/vmlinuz-2.6.31-20-generic root=UUID=d4f7b656-5965-43fb-acc2-5bc98e3ba8c6 ro quiet splash
ProcEnviron:
 LANGUAGE=
 LANG=fr_CH.UTF-8
 SHELL=/bin/bash
ProcVersionSignature: Ubuntu 2.6.31-20.57-generic
RelatedPackageVersions:
 linux-backports-modules-2.6.31-20-generic N/A
 linux-firmware 1.26
RfKill:

SourcePackage: linux
Symptom: storage
UdevMonitorLog:
 monitor will print the received events for:
 UDEV - the event which udev sends out after rule processing
Uname: Linux 2.6.31-20-generic x86_64
dmi.bios.date: 02/25/2009
dmi.bios.vendor: American Megatrends Inc.
dmi.bios.version: 2001
dmi.board.asset.tag: To Be Filled By O.E.M.
dmi.board.name: P5Q-E
dmi.board.vendor: ASUSTeK Computer INC.
dmi.board.version: Rev 1.xx
dmi.chassis.asset.tag: Asset-1234567890
dmi.chassis.type: 3
dmi.chassis.vendor: Chassis Manufacture
dmi.chassis.version: Chassis Version
dmi.modalias: dmi:bvnAmericanMegatrendsInc.:bvr2001:bd02/25/2009:svnSystemmanufacturer:pnP5Q-E:pvrSystemVersion:rvnASUSTeKComputerINC.:rnP5Q-E:rvrRev1.xx:cvnChassisManufacture:ct3:cvrChassisVersion:
dmi.product.name: P5Q-E
dmi.product.version: System Version
dmi.sys.vendor: System manufacturer

[starslights (starslights)]

Hello,

I will asking if there no workaround for that, now i have only this warn on my log and can't see any others problems or infos.

It non stop 2010-03-14 10:22:38 moon kernel [28926.222884] Valid eCryptfs headers not found in file header region or xattr region
2010-03-14 10:22:38 moon kernel [28926.222889] Either the lower file is not in a valid eCryptfs format, or the key could not be retrieved. Plaintext passthrough mode is not enabled; returning -EIO

So it really bad and i dunno if are why my system crashed 2 x times yesterday.

[Jesse Michael (jesse.michael)]

I was getting lots of these errors showing up in my kernel log also, so I've switched back to an unencrypted homedir on my laptop for now. I don't know if I've had any file corruption due to this problem, but it was making me pretty nervous.

[eriksornes (eriksornes)]

I have been running kubuntu 9.10 with ext4 and encrypted homedirectory happily for months, then suddenly, on 28th of mars this year, this exact same messages start appearing.
No other errors or problems are encounted on the system, be it hardware, software or user experience.
-strange
I don't really care som much for the data on my computer, but we should get to the bottom of this somehow, on day.

[Leonardo Silva Amaral (leleobhz)]

Same Here:

Apr 18 12:15:50 luana kernel: [103939.327219] Valid eCryptfs headers not found in file header region or xattr region
Apr 18 12:15:50 luana kernel: [103939.327234] Either the lower file is not in a valid eCryptfs format, or the key could not be retrieved. Plaintext passthrough mode is not enabled; returning -EIO
Apr 18 12:15:50 luana kernel: [103939.332863] Valid eCryptfs headers not found in file header region or xattr region
Apr 18 12:15:50 luana kernel: [103939.332890] Either the lower file is not in a valid eCryptfs format, or the key could not be retrieved. Plaintext passthrough mode is not enabled; returning -EIO

[Adam B Butler (adambbutler)]

Same here. Is this (so far) only showing up in <span name=z9 id=z9 style='color:#000;background-color:yellow;'>Karmic</span> systems running atop AMD64 kernels/hardware?

I'm starting to regret that I went for the whole "encrypt home directory" option with this laptop's <span name=z9 id=z9 style='color:#000;background-color:yellow;'>Karmic</span> install; it's my primary machine and over the months I've managed to fill my home directory with a large amount of data. (Where large is defined as "more MB/GB than there is currently available free space on the hard disk."

Like a previous poster (above) I think I'd rather be safe than sorry and "roll back" to an unencrypted setup, at least for now -- but from what I can tell, there isn't really a way to "decrypt" my home directory *in place* -- or is there? If at all possible, I'd like to avoid the "copy all the data out (would need to buy an external hard disk, I suppose), then remove/uninstall ecryptfs from the home directory, and finally copy all that data (back) to my home directory" shuffle?

Ugh. It's disappointing how a (seemingly innocuous, simple) install-time option could work perfectly for months and then cause (or at least potentially threaten) concern about virtually *all* my data, documents, etc. Yikes!

Linux 2.6.31-20-generic #58-Ubuntu SMP Fri Mar 12 04:38:19 UTC 2010 x86_64 GNU/Linux

$ lsb_release -dc
Description: Ubuntu 9.10
Codename: karmic

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[stricjux (luka-birsa)]

This is still present in:
Linux xxxxxxxx 3.0.0-14-generic #23-Ubuntu SMP Mon Nov 21 20:28:43 UTC 2011 x86_64 x86_64 x86_64 GNU/Linux

Are my files in danger?

[Nguyen Anh Minh (minhna)]

I got this error too.

Linux xxxxxx 3.2.0-26-generic #41-Ubuntu SMP Thu Jun 14 17:49:24 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux

[Heath Hunnicutt (heath-hunnicutt)]

I don't believe the formerly blamed item 509180 is truly the source of these errors. I have read that complete bug thread, and the error messages being posted there are similar to this error message. However, there is a critically important difference between the error messages.

Bug 509180:
    1. Some users are posting error messages which are due to an overly verbose ecryptfs module reporting normal operation when a system call is interrupted: return EINTR.
    2. The root issue being explored is a report of data corruption, and incorrectly reported file lengths, using ecryptfs.

This bug:
    1. The error message indicates a real problem in the ecryptfs operation, not merely forwarding an error condition from a lower-level call.
    2. Nobody has reported the issue (2) from 509180.

My experience with this bug:

uname -a: Linux x 2.6.38-15-generic #61-Ubuntu SMP Tue Jun 12 time 2012 i686 i686 i386 GNU/Linux

I have been using ecryptfs for 2 years on this laptop, multiple Ubuntu upgrades, never gave the module any thought.

Yesterday I rebuilt from source the module udlfb (USB Displaylink Frame Buffer) as found on git Fetch URL http://git.plugable.com/webdav/udlfb

Although I invoked "sudo make install", the kernel module was built into /lib/modules/`uname -r`/updates and I saw output from depmod but modules.dep and modules.order had not been updated and still pointed to the "stock" module.

I did a "sudo modprobe udlfb.ko" in the updates subdirectory, then a depmod, then rebooted.

ecryptfs module failed to load. Of course my home dir was missing. In fact, output from "lsmod" showed that only a couple of dozens modules were loaded, top among them being udlfb, with 0 references (wrong dependencies for it, obvious to me), and i915, but practically nothing else. Wireless (ath9k) was missing. Checking right now, my normal "lsmod | wc -l" is 64.

Figuring dependencies were wrong, I re-ran modprobe and depmod. I powered down, rebooted, and had no improvement. I powered down again, waited a long time to log in, and everything was in working order.

Checking dmesg, I see there was an error from ecryptfs logged 15 minutes after boot:

[ 922.072990] Valid eCryptfs headers not found in file header region or xattr region
[ 922.072994] Either the lower file is not in a valid eCryptfs format, or the key could not be retrieved. Plaintext passthrough mode is not enabled; returning -EIO
[ 926.000041] wlan0: authenticate with 00:26:82:f0:f6:f2 (try 1)

It appears that this occurred while I was logging in. Checking /var/log/kern.log, the error has only been in my log twice, starts only after the episode in which many modules did not load.

[Heath Hunnicutt (heath-hunnicutt)]

On further inspection, I never have had an ecryptfs.ko in /lib/modules. On what modules does ecryptfs depend?

[Po-Hsu Lin (cypressyew)]

Closing this bug with Won't fix as this kernel / release is no longer supported.
Please feel free to open a new bug report if you're still experiencing this on a newer release (Bionic 18.04.3 / Disco 19.04)
Thanks!