ecryptfs_read_lower errors

Bug #400443 reported by lunch
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
eCryptfs
Fix Released
Low
Tyler Hicks
linux (Ubuntu)
Fix Released
Low
Unassigned
Lucid
Fix Released
Low
Colin Ian King

Bug Description

I installed some new fonts today, copied them manually into ~/.fonts so I proceeded with:
$ fc-cache -f
$ mkfontscale ~/.fonts

...at which point mkfontscale failed with:
zsh: bus error mkfontscale

I tried the same with "mkfontdir" and the same thing happened. However both tools did create a "fonts.{scale,dir}" file respectively, both empty files. I checked my kernel logs and found many of these messages:

======================================================
ecryptfs_read_lower: octets_read = [-21]; expected [4096]
ecryptfs_read_lower: octets_read = [-21]; expected [4096]
ecryptfs_read_lower: octets_read = [-21]; expected [4096]
======================================================

... and nothing else. What follows is the output of `strace mkfontscale`

======================================================
execve("/usr/bin/mkfontscale", ["mkfontscale"], [/* 57 vars */]) = 0
brk(0) = 0x9599000
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=119571, ...}) = 0
mmap2(NULL, 119571, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7fb5000
close(3) = 0
open("/usr/lib/libfontenc.so.1", O_RDONLY) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0 \r\0\0004\0\0\0004"..., 512) = 512
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fb4000
fstat64(3, {st_mode=S_IFREG|0755, st_size=30063, ...}) = 0
mmap2(NULL, 24288, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7fae000
mmap2(0xb7fb3000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x5) = 0xb7fb3000
close(3) = 0
open("/usr/lib/libfreetype.so.6", O_RDONLY) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0`}\0\0004\0\0\0,"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=604088, ...}) = 0
mmap2(NULL, 542228, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7f29000
mmap2(0xb7faa000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x81) = 0xb7faa000
close(3) = 0
open("/usr/lib/libz.so.1", O_RDONLY) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\260\30\0\0004\0\0\0\30"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=82987, ...}) = 0
mmap2(NULL, 78844, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7f15000
mmap2(0xb7f28000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x12) = 0xb7f28000
close(3) = 0
open("/lib/libc.so.6", O_RDONLY) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\220k\1\0004\0\0\0\0"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=1584604, ...}) = 0
mmap2(NULL, 1333512, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7dcf000
mmap2(0xb7f0f000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x140) = 0xb7f0f000
mmap2(0xb7f12000, 10504, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb7f12000
close(3) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7dce000
set_thread_area({entry_number:-1 -> 6, base_addr:0xb7dce8d0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0
mprotect(0xb7f0f000, 8192, PROT_READ) = 0
mprotect(0xb7ff0000, 4096, PROT_READ) = 0
munmap(0xb7fb5000, 119571) = 0
getcwd("/home/lunch/.fonts"..., 1023) = 19
brk(0) = 0x9599000
brk(0x95ba000) = 0x95ba000
open("./", O_RDONLY|O_NONBLOCK|O_LARGEFILE|O_DIRECTORY|O_CLOEXEC) = 3
fcntl64(3, F_GETFD) = 0x1 (flags FD_CLOEXEC)
open("./fonts.scale", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
getdents(3, /* 80 entries */, 32768) = 2304
open("./.", O_RDONLY) = 5
fcntl64(5, F_SETFD, FD_CLOEXEC) = 0
fstat64(5, {st_mode=S_IFDIR|0755, st_size=16384, ...}) = 0
mmap2(NULL, 16384, PROT_READ, MAP_PRIVATE, 5, 0) = 0xb7fcf000
close(5) = 0
--- SIGBUS (Bus error) @ 0 (0) ---
+++ killed by SIGBUS +++
======================================================

Revision history for this message
Dustin Kirkland  (kirkland) wrote :

Tyler,

Can you take a look at this one?

:-Dustin

Changed in ecryptfs:
importance: Undecided → Medium
tags: added: kernel
Changed in ecryptfs:
assignee: nobody → Tyler Hicks (tyhicks)
summary: - xorg-font-utils do not work in an active eCryptfs mount
+ ecryptfs_read_lower errors
Tyler Hicks (tyhicks)
Changed in ecryptfs:
status: New → Confirmed
importance: Medium → Low
Tyler Hicks (tyhicks)
Changed in ecryptfs:
status: Confirmed → In Progress
Revision history for this message
Tyler Hicks (tyhicks) wrote :
Changed in ecryptfs:
status: In Progress → Fix Released
Revision history for this message
Colin Ian King (colin-king) wrote :

SRU Justification:

mmap() on a directory should return ENODEV, but on ecryptfs mmap() on Lucid returns
a mmap'd address which causes a SIGBUS when accessed.

Fix: Apply the backported patch, open a directory on an ecryptfs filesystem
and mmap with mmap(NULL, 4096, PROT_READ, MAP_PRIVATE, fd, 0). With the fix
this returns ENODEV, without it mmap returns a mmap'd region which causes a SIGBUS
when accessed.

The attached C test program exercises this bug and works correctly with the fix.

affects: linux → ubuntu
no longer affects: ubuntu
Revision history for this message
Colin Ian King (colin-king) wrote :

Note: SRU for Ubuntu Lucid

Tim Gardner (timg-tpi)
Changed in linux (Ubuntu Lucid):
status: New → Fix Committed
Changed in linux (Ubuntu):
status: New → Fix Released
Revision history for this message
Herton R. Krzesinski (herton) wrote :

The commit for this issue in Lucid is an early application of a commit that will be coming in via upstream stable (2.6.32.58). As such it is not subject to the standard bug verification process.

tags: added: verification-done-lucid
Changed in linux (Ubuntu Lucid):
assignee: nobody → Colin King (colin-king)
Changed in linux (Ubuntu):
importance: Undecided → Low
Changed in linux (Ubuntu Lucid):
importance: Undecided → Low
Revision history for this message
Colin Ian King (colin-king) wrote :

Tested and verified working for Lucid -proposed i386 2.6.32-40.87

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package linux - 2.6.32-40.87

---------------
linux (2.6.32-40.87) lucid-proposed; urgency=low

  [Herton R. Krzesinski]

  * Release Tracking Bug
    - LP: #947375

  [ Upstream Kernel Changes ]

  * IB/mlx4: pass SMP vendor-specific attribute MADs to firmware
    - LP: #932043
  * mm/filemap_xip.c: fix race condition in xip_file_fault()
    - LP: #932043
  * NFSv4: Fix up the callers of nfs4_state_end_reclaim_reboot
    - LP: #932043
  * NFSv4: The state manager shouldn't exit on errors that were handled
    - LP: #932043
  * NFSv4: Ensure the state manager handles NFS4ERR_NO_GRACE correctly
    - LP: #932043
  * NFSv4: Handle NFS4ERR_GRACE when recovering an expired lease.
    - LP: #932043
  * NFSv4: Fix open recovery
    - LP: #932043
  * rpc client can not deal with ENOSOCK, so translate it into ENOCONN
    - LP: #932043
  * udf: Mark LVID buffer as uptodate before marking it dirty
    - LP: #932043
  * eCryptfs: Infinite loop due to overflow in ecryptfs_write()
    - LP: #932043
  * atmel_lcdfb: fix usage of CONTRAST_CTR in suspend/resume
    - LP: #932043
  * Staging: asus_oled: fix image processing
    - LP: #932043
  * Staging: android: binder: Don't call dump_stack in binder_vma_open
    - LP: #932043
  * Staging: android: binder: Fix crashes when sharing a binder file
    between processes
    - LP: #932043
  * usb: gadget: zero: fix bug in loopback autoresume handling
    - LP: #932043
  * usb: Skip PCI USB quirk handling for Netlogic XLP
    - LP: #932043
  * USB: usbserial: add new PID number (0xa951) to the ftdi driver
    - LP: #932043
  * mmc: cb710 core: Add missing spin_lock_init for irq_lock of struct
    cb710_chip
    - LP: #932043
  * net: fix sk_forward_alloc corruptions
    - LP: #932043
  * net: sock_queue_err_skb() dont mess with sk_forward_alloc
    - LP: #932043
  * Linux 2.6.32.57
    - LP: #932043
  * Ban ecryptfs over ecryptfs
    - LP: #932987
  * eCryptfs: Remove mmap from directory operations
    - LP: #400443
  * eCryptfs: Use notify_change for truncating lower inodes
    - LP: #451368
  * ecryptfs: read on a directory should return EISDIR if not supported
    - LP: #719691
  * eCryptfs: Remove extra d_delete in ecryptfs_rmdir
    - LP: #723518
  * eCryptfs: Clear i_nlink in rmdir
    - LP: #723518
  * KVM: Device assignment permission checks
    - LP: #897812
    - CVE-2011-4347
  * block: Fix io_context leak after clone with CLONE_IO
    - LP: #940743
    - CVE-2012-0879
  * block: Fix io_context leak after failure of clone with CLONE_IO
    - LP: #940743
    - CVE-2012-0879
  * eCryptfs: Handle failed metadata read in lookup
    - LP: #509180
  * drm/i915: Fix TV Out refresh rate.
    - LP: #945114
  * Linux 2.6.32.57+drm33.23
    - LP: #945114
 -- Herton Ronaldo Krzesinski <email address hidden> Mon, 05 Mar 2012 16:09:18 -0300

Changed in linux (Ubuntu Lucid):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.