NFS + sec=krb5 is broken

Bug #1759791 reported by mtemp
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Fix Released
Medium
Joseph Salisbury
Bionic
Fix Released
Medium
Joseph Salisbury

Bug Description

I am testing the development branch of Bionic Beaver.
With the latest update to kernel 4.15.0-13 my nfs-mounts in a university network are broken.

> sudo mount -vvv -t nfs4 my_server:/my/share /nfs -osoft,sec=krb5
> mount.nfs4: timeout set for Mon Mar 26 16:29:56 2018
> mount.nfs4: trying text-based options 'soft,sec=krb5,nfsvers=4.0,addr=10.162.229.2,clientaddr=10.152.249.189'
> mount.nfs4: mount(2): Input/output error
> mount.nfs4: mount system call failed

> kernel: NFS: nfs4_discover_server_trunking unhandled error -5. Exiting with error EIO
> kernel: RPC: couldn't encode RPC header, exit EIO
> kernel: gss_marshal: gss_get_mic FAILED (851968)

Known good version: linux-image-4.15.0-10

I think it is the same bug like in https://bugzilla.redhat.com/show_bug.cgi?id=1558977
The bug was introduced in the mainline kernel 4.15.4 with commit "[46e8d06e423c4f35eac7a8b677b713b3ec9b0684] crypto: hash - prevent using keyed hashes without setting key"

This bug should be fixed before releasing ubuntu18.04 by either reverting the commit or using a fixed mainline kernel.
---
ApportVersion: 2.20.9-0ubuntu1
Architecture: amd64
AudioDevicesInUse:
 USER PID ACCESS COMMAND
 /dev/snd/controlC1: gdm 1340 F.... pulseaudio
 /dev/snd/controlC0: gdm 1340 F.... pulseaudio
DistroRelease: Ubuntu 18.04
InstallationDate: Installed on 2018-03-22 (6 days ago)
InstallationMedia: Ubuntu 18.04 LTS "Bionic Beaver" - Alpha amd64 (20180321)
IwConfig:
 lo no wireless extensions.

 enp0s31f6 no wireless extensions.
Lsusb:
 Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
 Bus 001 Device 003: ID 046a:b091 Cherry GmbH
 Bus 001 Device 002: ID 0bf8:101e Fujitsu Siemens Computers
 Bus 001 Device 004: ID 0bda:0184 Realtek Semiconductor Corp. RTS5182 Card Reader
 Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
MachineType: FUJITSU ESPRIMO D757
Package: linux (not installed)
ProcFB: 0 nouveaufb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-4.15.0-13-generic root=UUID=463c4c1b-7771-40dd-833f-f4d68a5fd914 ro quiet splash vt.handoff=1
ProcVersionSignature: Ubuntu 4.15.0-13.14-generic 4.15.10
PulseList: Error: command ['pacmd', 'list'] failed with exit code 1: No PulseAudio daemon running, or not running as session daemon.
RelatedPackageVersions:
 linux-restricted-modules-4.15.0-13-generic N/A
 linux-backports-modules-4.15.0-13-generic N/A
 linux-firmware 1.173
RfKill:

Tags: bionic
Uname: Linux 4.15.0-13-generic x86_64
UnreportableReason: Der Bericht gehört zu einem nicht installierten Paket.
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups:

_MarkForUpload: False
dmi.bios.date: 10/12/2017
dmi.bios.vendor: FUJITSU // American Megatrends Inc.
dmi.bios.version: V5.0.0.12 R1.14.0 for D3531-A1x
dmi.board.name: D3531-A1
dmi.board.vendor: FUJITSU
dmi.board.version: S26361-D3531-A1
dmi.chassis.type: 3
dmi.chassis.vendor: FUJITSU
dmi.modalias: dmi:bvnFUJITSU//AmericanMegatrendsInc.:bvrV5.0.0.12R1.14.0forD3531-A1x:bd10/12/2017:svnFUJITSU:pnESPRIMOD757:pvr:rvnFUJITSU:rnD3531-A1:rvrS26361-D3531-A1:cvnFUJITSU:ct3:cvr:
dmi.product.family: ESPRIMO-FTS
dmi.product.name: ESPRIMO D757
dmi.sys.vendor: FUJITSU

CVE References

Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote : Missing required logs.

This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:

apport-collect 1759791

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux (Ubuntu):
status: New → Incomplete
Revision history for this message
mtemp (mtemp) wrote : AlsaInfo.txt

apport information

tags: added: apport-collected bionic
description: updated
Revision history for this message
mtemp (mtemp) wrote : CRDA.txt

apport information

Revision history for this message
mtemp (mtemp) wrote : CurrentDmesg.txt

apport information

Revision history for this message
mtemp (mtemp) wrote : JournalErrors.txt

apport information

Revision history for this message
mtemp (mtemp) wrote : Lspci.txt

apport information

Revision history for this message
mtemp (mtemp) wrote : ProcCpuinfoMinimal.txt

apport information

Revision history for this message
mtemp (mtemp) wrote : ProcEnviron.txt

apport information

Revision history for this message
mtemp (mtemp) wrote : ProcInterrupts.txt

apport information

Revision history for this message
mtemp (mtemp) wrote : ProcModules.txt

apport information

Revision history for this message
mtemp (mtemp) wrote : UdevDb.txt

apport information

Revision history for this message
mtemp (mtemp) wrote : WifiSyslog.txt

apport information

Changed in linux (Ubuntu):
status: Incomplete → Confirmed
Revision history for this message
Joseph Salisbury (jsalisbury) wrote :

I can build a Bionic test kernel with that commit reverted.

Could you also test the current mainline kernel to see if the bug is fixed in another way? It can be downloaded from;

http://kernel.ubuntu.com/~kernel-ppa/mainline/v4.16-rc7

Changed in linux (Ubuntu Bionic):
assignee: nobody → Joseph Salisbury (jsalisbury)
importance: Undecided → Medium
status: Confirmed → In Progress
Revision history for this message
Joseph Salisbury (jsalisbury) wrote :

I built a test kernel with a revert of mainline commit 9fa68f6. The test kernel can be downloaded from:
http://kernel.ubuntu.com/~jsalisbury/lp1759791

Can you test this kernel and see if it resolves this bug?

Note, to test this kernel, you need to install both the linux-image and linux-image-extra .deb packages.

Thanks in advance!

Revision history for this message
mtemp (mtemp) wrote :

Thanks for the kernel!
Unfortunately I am off the grid until April 9, but I hope a colleague of mine will test it for me.

One small remark: I might have mixed up the terms "stable kernel" and "mainline kernel". Sry for that!
The mentioned bug first occurred in the *stable* Kernel kernel 4.15.4
Additionally, according to https://marc.info/?l=linux-netdev&m=152225946901789&w=2 the commit only triggered the bug, but the problem has existed for 8 years.

Revision history for this message
Michael Pehl (mpehl) wrote :

Thanks for the kernel also from my side. I just installed like suggested so that I have
$ uname -a
Linux pcname 4.15.0-12-generic #13~lp1759791Commit9fa68f6Reverted SMP Fri Mar 30 19:52:22 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

This kernel seems to resolve the bug.

Thank you!

Revision history for this message
Joseph Salisbury (jsalisbury) wrote :
Revision history for this message
Joseph Salisbury (jsalisbury) wrote :

This is actually a commit in linux-next that appears to be the fix to this bug. I built a test kernel with this patch, which is commit 190b22eedd032c14cbc2b9e13d112f039460522c.

The test kernel can be downloaded from:
http://kernel.ubuntu.com/~jsalisbury/lp1759791

Can you test this kernel and see if it resolves this bug?

Note, to test this kernel, you need to install both the linux-image and linux-image-extra .deb packages.

Thanks in advance!

Revision history for this message
Michael Pehl (mpehl) wrote :

I have now installed the two deb packages and tested with
"Linux pcname 4.15.0-12-generic #13~lp1759791Patched SMP Tue Apr 3 18:54:53 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux"
The mount works well!
Thank you!

Revision history for this message
mtemp (mtemp) wrote :

Thanks for the great work.
Will you patch the ubuntu kernel in advance or do we need to wait until the patch is in the mainline kernel?

Seth Forshee (sforshee)
Changed in linux (Ubuntu Bionic):
status: In Progress → Fix Committed
Revision history for this message
mtemp (mtemp) wrote :

Thanks for the fix.
Can you make an educated guess when the fix will be released?

Revision history for this message
mtemp (mtemp) wrote :
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (35.7 KiB)

This bug was fixed in the package linux - 4.15.0-19.20

---------------
linux (4.15.0-19.20) bionic; urgency=medium

  * linux: 4.15.0-19.20 -proposed tracker (LP: #1766021)

  * Kernel 4.15.0-15 breaks Dell PowerEdge 12th Gen servers (LP: #1765232)
    - Revert "blk-mq: simplify queue mapping & schedule with each possisble CPU"
    - Revert "genirq/affinity: assign vectors to all possible CPUs"

linux (4.15.0-18.19) bionic; urgency=medium

  * linux: 4.15.0-18.19 -proposed tracker (LP: #1765490)

  * [regression] Ubuntu 18.04:[4.15.0-17-generic #18] KVM Guest Kernel:
    meltdown: rfi/fallback displacement flush not enabled bydefault (kvm)
    (LP: #1765429)
    - powerpc/pseries: Fix clearing of security feature flags

  * signing: only install a signed kernel (LP: #1764794)
    - [Packaging] update to Debian like control scripts
    - [Packaging] switch to triggers for postinst.d postrm.d handling
    - [Packaging] signing -- switch to raw-signing tarballs
    - [Packaging] signing -- switch to linux-image as signed when available
    - [Config] signing -- enable Opal signing for ppc64el
    - [Packaging] printenv -- add signing options

  * [18.04 FEAT] Sign POWER host/NV kernels (LP: #1696154)
    - [Packaging] signing -- add support for signing Opal kernel binaries

  * Please cherrypick s390 unwind fix (LP: #1765083)
    - s390/compat: fix setup_frame32

  * Ubuntu 18.04 installer does not detect any IPR based HDD/RAID array [S822L]
    [ipr] (LP: #1751813)
    - d-i: move ipr to storage-core-modules on ppc64el

  * drivers/gpu/drm/bridge/adv7511/adv7511.ko missing (LP: #1764816)
    - SAUCE: (no-up) rename the adv7511 drm driver to adv7511_drm

  * Miscellaneous Ubuntu changes
    - [Packaging] Add linux-oem to rebuild test blacklist.

linux (4.15.0-17.18) bionic; urgency=medium

  * linux: 4.15.0-17.18 -proposed tracker (LP: #1764498)

  * Eventual OOM with profile reloads (LP: #1750594)
    - SAUCE: apparmor: fix memory leak when duplicate profile load

linux (4.15.0-16.17) bionic; urgency=medium

  * linux: 4.15.0-16.17 -proposed tracker (LP: #1763785)

  * [18.04] [bug] CFL-S(CNP)/CNL GPIO testing failed (LP: #1757346)
    - [Config]: Set CONFIG_PINCTRL_CANNONLAKE=y

  * [Ubuntu 18.04] USB Type-C test failed on GLK (LP: #1758797)
    - SAUCE: usb: typec: ucsi: Increase command completion timeout value

  * Fix trying to "push" an already active pool VP (LP: #1763386)
    - SAUCE: powerpc/xive: Fix trying to "push" an already active pool VP

  * hisi_sas: Revert and replace SAUCE patches w/ upstream (LP: #1762824)
    - Revert "UBUNTU: SAUCE: scsi: hisi_sas: export device table of v3 hw to
      userspace"
    - Revert "UBUNTU: SAUCE: scsi: hisi_sas: config for hip08 ES"
    - scsi: hisi_sas: modify some register config for hip08
    - scsi: hisi_sas: add v3 hw MODULE_DEVICE_TABLE()

  * Realtek card reader - RTS5243 [VEN_10EC&DEV_5260] (LP: #1737673)
    - misc: rtsx: Move Realtek Card Reader Driver to misc
    - updateconfigs for Realtek Card Reader Driver
    - misc: rtsx: Add support for RTS5260
    - misc: rtsx: Fix symbol clashes

  * Mellanox [mlx5] [bionic] UBSAN: Undefined behaviour in
    ./include/linux/net_dim.h (LP: #1...

Changed in linux (Ubuntu Bionic):
status: Fix Committed → Fix Released
Revision history for this message
Robert Schetterer (rschetterer) wrote :

Bug in hwe-edge kernel 4.15.0.15.40
 posted also here
https://bugs.launchpad.net/ubuntu/+source/linux-hwe-edge/+bug/1768545
please fix there too

Revision history for this message
Brad Figg (brad-figg) wrote :

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-bionic' to 'verification-done-bionic'. If the problem still exists, change the tag 'verification-needed-bionic' to 'verification-failed-bionic'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-bionic
Revision history for this message
Robert Schetterer (rschetterer) wrote :

Hi Brad, what means your
"dropped from the source code"
we all hope that you do not revert the patch by deleting the bug ticket
Greetz Robert

Andy Whitcroft (apw)
tags: added: kernel-fixup-verification-needed-bionic
removed: verification-needed-bionic
Revision history for this message
Andy Whitcroft (apw) wrote :

This bug was erroneously marked for verification in bionic; verification is not required and verification-needed-bionic is being removed.

tags: added: verification-done-bionic
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.