Merge ~bluca/ubuntu/+source/lvm2:errno_backport into ubuntu/+source/lvm2:ubuntu/devel

[Luca Boccassi]

libdm: backport patch to fix return code from device-mapper

When libcryptsetup tries to activate a signed dm-verity volume, and the key is not in the kernel keyring, libdevicemapper does not return the appropriate ENOKEY, so the failure cannot be distinguished from other generic issues.

This is fixed in the lvm2 version 2.03.23 upstream release.

Please consider backporting this patch for Noble.

Upstream PR: https://gitlab.com/lvmteam/lvm2/-/merge_requests/3
Upstream commit: 25ef7a7b1a876f491bd361369423d7309358f6c1

[Gianfranco Costamagna (costamagnagianfranco)]

review: Approve

Unmerged commits

d4580c5... by Luca Boccassi on 2024-02-22

libdm: backport patch to fix return code from device-mapper

Backport patch from latest upstream lvm2 version. Fixes returning an
accurate error code to libcryptsetup when opening a dm-verity device
fails due to a missing key. Needed for cryptsetup 2.7.0 and systemd
256.

diff --git a/debian/patches/libdm-propagate-ioctl-errors-back-to-caller.patch b/debian/patches/libdm-propagate-ioctl-errors-back-to-caller.patch
new file mode 100644
index 0000000..f0f49f0
--- /dev/null
+++ b/debian/patches/libdm-propagate-ioctl-errors-back-to-caller.patch
@@ -0,0 +1,67 @@
+Author: Lennart Poettering <[e-mail]>
+Origin: upstream, commit:25ef7a7b1a876f491bd361369423d7309358f6c1
+Forwarded: https://gitlab.com/lvmteam/lvm2/-/merge_requests/3
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/lvm2/+bug/2054620
+Description: libdm: propagate ioctl errors back to caller
+ When setting up dm-verity devices with signed root hashes it is very
+ useful to have a recognizable error code when a key is not present in
+ the kernel keyring. Turns out the kernel actually returns ENOKEY in that
+ case, but this gets lost in libdevmapper.
+ .
+ This fixes this: in _create_and_load_v4() it copies the error code from
+ the ioctl from the sub-tasks back to the main task field on failure.
+ .
+ This is not enough to make libcryptsetup actually propagate the ENOKEY
+ correctly, that also needs a patch to libcryptsetup, but this is part of
+ the puzzle.
+--- a/libdm/ioctl/libdm-iface.c
++++ b/libdm/ioctl/libdm-iface.c
+@@ -1471,7 +1471,7 @@ static int _create_and_load_v4(struct dm_task *dmt)
+ {
+ 	struct dm_info info;
+ 	struct dm_task *task;
+-	int r;
++	int r, ioctl_errno = 0;
+ 	uint32_t cookie;
+ 
+ 	/* Use new task struct to create the device */
+@@ -1497,8 +1497,10 @@ static int _create_and_load_v4(struct dm_task *dmt)
+ 	task->cookie_set = dmt->cookie_set;
+ 	task->add_node = dmt->add_node;
+ 
+-	if (!dm_task_run(task))
++	if (!dm_task_run(task)) {
++		ioctl_errno = task->ioctl_errno;
+ 		goto_bad;
++	}
+ 
+ 	if (!dm_task_get_info(task, &info) || !info.exists)
+ 		goto_bad;
+@@ -1529,6 +1531,8 @@ static int _create_and_load_v4(struct dm_task *dmt)
+ 	task->ima_measurement = dmt->ima_measurement;
+ 
+ 	r = dm_task_run(task);
++	if (!r)
++		ioctl_errno = task->ioctl_errno;
+ 
+ 	task->head = NULL;
+ 	task->tail = NULL;
+@@ -1575,12 +1579,18 @@ static int _create_and_load_v4(struct dm_task *dmt)
+ 	if (!dm_task_run(dmt))
+ 		log_error("Failed to revert device creation.");
+ 
++	if (ioctl_errno != 0)
++		dmt->ioctl_errno =  ioctl_errno;
++
+ 	return 0;
+ 
+       bad:
+ 	dm_task_destroy(task);
+ 	_udev_complete(dmt);
+ 
++	if (ioctl_errno != 0)
++		dmt->ioctl_errno =  ioctl_errno;
++
+ 	return 0;
+ }
+ 
diff --git a/debian/patches/series b/debian/patches/series
index a4eda8e..6f44f58 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -2,3 +2,4 @@ debian-changes
 enable-issue-discards.patch
 0014-no-lvm2-monitor-in-containers.patch
 fix-systemd-run-location.patch
+libdm-propagate-ioctl-errors-back-to-caller.patch