{"action":"closed","issue":{"url":"https://api.github.com/repos/sonyxperiadev/bug_tracker/issues/57","repository_url":"https://api.github.com/repos/sonyxperiadev/bug_tracker","labels_url":"https://api.github.com/repos/sonyxperiadev/bug_tracker/issues/57/labels{/name}","comments_url":"https://api.github.com/repos/sonyxperiadev/bug_tracker/issues/57/comments","events_url":"https://api.github.com/repos/sonyxperiadev/bug_tracker/issues/57/events","html_url":"https://github.com/sonyxperiadev/bug_tracker/issues/57","id":279249020,"number":57,"title":"[maple] Ext4 encryption causes kernel crash","user":{"login":"jamuir","id":5332385,"avatar_url":"https://avatars2.githubusercontent.com/u/5332385?v=4","gravatar_id":"","url":"https://api.github.com/users/jamuir","html_url":"https://github.com/jamuir","followers_url":"https://api.github.com/users/jamuir/followers","following_url":"https://api.github.com/users/jamuir/following{/other_user}","gists_url":"https://api.github.com/users/jamuir/gists{/gist_id}","starred_url":"https://api.github.com/users/jamuir/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jamuir/subscriptions","organizations_url":"https://api.github.com/users/jamuir/orgs","repos_url":"https://api.github.com/users/jamuir/repos","events_url":"https://api.github.com/users/jamuir/events{/privacy}","received_events_url":"https://api.github.com/users/jamuir/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2017-12-05T05:15:01Z","updated_at":"2017-12-08T11:06:44Z","closed_at":"2017-12-08T11:06:44Z","author_association":"NONE","body":"**Platform:** yoshino\r\n**Device:** maple\r\n**Kernel version:** 4.4\r\n**Android version:** 7.1.1\r\n\r\n**Description**\r\nBasic ext4 encryption is broken.\r\nWhen you try to create a file in an ext4 encrypted directory, the kernel crashes due to a null pointer dereference.\r\n\r\nKernel log grabbed from `/sys/fs/pstore/`:\r\n\r\n```\r\n<1>[  523.763767] Unable to handle kernel NULL pointer dereference at virtual address 00000010\r\n<1>[  523.766855] pgd = ffffffc0d6c4a000\r\n<1>[  523.767153] [00000010] *pgd=0000000000000000, *pud=0000000000000000\r\n<6>[  523.767979] ------------[ cut here ]------------\r\n<2>[  523.768401] Kernel BUG at ffffff8008248a70 [verbose debug info unavailable]\r\n<0>[  523.768644] Internal error: Oops - BUG: 96000005 [#1] PREEMPT SMP\r\n<6>[  523.769099] CPU: 0 PID: 2490 Comm: sh Tainted: G        W       4.4.21-gffc04ed-dirty #3\r\n<6>[  523.769520] Hardware name: SoMC Maple-ROW(MSM8998 v2.1) (DT)\r\n<6>[  523.769757] task: ffffffc059aff080 ti: ffffffc0dbf3c000 task.ti: ffffffc0dbf3c000\r\n<6>[  523.770230] PC is at ext4_fname_encrypt+0x238/0x3e8\r\n<6>[  523.770469] LR is at ext4_fname_encrypt+0x230/0x3e8\r\n<6>[  523.770896] pc : [<ffffff8008248a70>] lr : [<ffffff8008248a68>] pstate: 80000145\r\n<6>[  523.771126] sp : ffffffc0dbf3f990\r\n<6>[  523.771546] x29: ffffffc0dbf3f990 x28: ffffffc0dbf3fa58 \r\n<6>[  523.772216] x27: 0000000000000000 x26: ffffffc0f9431e80 \r\n<6>[  523.773073] x25: ffffff8009207000 x24: ffffff8009207000 \r\n<6>[  523.773741] x23: ffffffc0dbf3fa18 x22: ffffffc0dbf3fa38 \r\n<6>[  523.774598] x21: ffffff80092070c0 x20: ffffff80092070b0 \r\n<6>[  523.775261] x19: 0000000000000010 x18: 0000006406ea8000 \r\n<6>[  523.775924] x17: 00000074bfbce81c x16: ffffff800818cbb0 \r\n<6>[  523.776779] x15: 2e8ba2e8ba2e8ba3 x14: 72632f347478652f \r\n<6>[  523.777444] x13: 73662f6d736d2f79 x12: 6e6f732f6c656e72 \r\n<6>[  523.778300] x11: ffffffc0dbf3f5e0 x10: 2f2e2e2f2e2e2f2e \r\n<6>[  523.778965] x9 : 0000000000000000 x8 : 00b0000b008200f3 \r\n<6>[  523.779823] x7 : 00a100c900c500b5 x6 : 0000000000000000 \r\n<6>[  523.780488] x5 : ffffffc07ffcb300 x4 : 0000000000000001 \r\n<6>[  523.781350] x3 : 0000000000000007 x2 : ffffffc0dbf3c000 \r\n<6>[  523.782022] x1 : 0000000000000000 x0 : ffffffc0f9431e80 \r\n<6>[  523.782696] \r\n<6>[  523.782696] PC: 0xffffff8008248a30:\r\n<6>[  523.782933] 8a30  94031e83 aa1403e0 aa1503e1 528010c2 97fbbd0d f9002357 f94033a4 aa1503e1\r\n<6>[  523.785381] 8a50  52801102 aa1403e0 f9001f44 f9002756 b9003353 97fbbd04 f9401341 aa1a03e0\r\n<6>[  523.787825] 8a70  f9400821 d63f0020 3100401f 2a0003f4 54000900 3101cc1f 540008c0 aa1b03e0\r\n<6>[  523.790082] 8a90  9102c335 91030316 97fcd0d0 aa1503e0 aa1603e1 52801202 97fbbcf3 aa1a03e0\r\n<6>[  523.792527] \r\n<6>[  523.792527] LR: 0xffffff8008248a28:\r\n<6>[  523.792763] 8a28  f9400001 aa1603e0 94031e83 aa1403e0 aa1503e1 528010c2 97fbbd0d f9002357\r\n<6>[  523.795168] 8a48  f94033a4 aa1503e1 52801102 aa1403e0 f9001f44 f9002756 b9003353 97fbbd04\r\n<6>[  523.797278] 8a68  f9401341 aa1a03e0 f9400821 d63f0020 3100401f 2a0003f4 54000900 3101cc1f\r\n<6>[  523.799467] 8a88  540008c0 aa1b03e0 9102c335 91030316 97fcd0d0 aa1503e0 aa1603e1 52801202\r\n<6>[  523.801855] \r\n<6>[  523.801855] SP: 0xffffffc0dbf3f950:\r\n<6>[  523.802277] f950  08248a68 ffffff80 dbf3f990 ffffffc0 08248a70 ffffff80 80000145 00000000\r\n<6>[  523.804473] f970  dbf3fa08 ffffffc0 7ffcb300 ffffffc0 00000000 00000080 00fd00a3 004b00ef\r\n<6>[  523.806861] f990  dbf3faa0 ffffffc0 082490b0 ffffff80 dbf3fbf0 ffffffc0 eb7e6808 ffffffc0\r\n<6>[  523.809243] f9b0  6eeeae60 ffffffc0 00000000 00000000 dbf3fc20 ffffffc0 00000041 00000000\r\n<6>[  523.811622] \r\n<0>[  523.811853] Process sh (pid: 2490, stack limit = 0xffffffc0dbf3c020)\r\n<6>[  523.812084] Call trace:\r\n<6>[  523.812326] Exception stack(0xffffffc0dbf3f7c0 to 0xffffffc0dbf3f8f0)\r\n<6>[  523.812757] f7c0: 0000000000000010 0000008000000000 ffffffc0dbf3f990 ffffff8008248a70\r\n<6>[  523.813191] f7e0: ffffff80091f7548 ffffff8009480d88 0000000100000000 ffffff8009626198\r\n<6>[  523.813433] f800: ffffffc0dbf3f810 ffffff80080ea20c ffffffc0dbf3f8b0 ffffff80080ea578\r\n<6>[  523.813864] f820: ffffff80080ea540 ffffff80092070b0 ffffff80092070c0 ffffffc0dbf3fa38\r\n<6>[  523.814296] f840: ffffffc0dbf3fa18 ffffff8009207000 ffffff8009207000 ffffffc0f9431e80\r\n<6>[  523.814535] f860: ffffffc0f9431e80 0000000000000000 ffffffc0dbf3c000 0000000000000007\r\n<6>[  523.814966] f880: 0000000000000001 ffffffc07ffcb300 0000000000000000 00a100c900c500b5\r\n<6>[  523.815398] f8a0: 00b0000b008200f3 0000000000000000 2f2e2e2f2e2e2f2e ffffffc0dbf3f5e0\r\n<6>[  523.815826] f8c0: 6e6f732f6c656e72 73662f6d736d2f79 72632f347478652f 2e8ba2e8ba2e8ba3\r\n<6>[  523.816060] f8e0: ffffff800818cbb0 00000074bfbce81c\r\n<6>[  523.816495] [<ffffff8008248a70>] ext4_fname_encrypt+0x238/0x3e8\r\n<6>[  523.816743] [<ffffff80082490b0>] ext4_fname_setup_filename+0x94/0x2a0\r\n<6>[  523.817181] [<ffffff8008217938>] ext4_find_entry+0x54/0x5bc\r\n<6>[  523.817419] [<ffffff8008217ef4>] ext4_lookup+0x54/0x240\r\n<6>[  523.817864] [<ffffff8008196c20>] lookup_real+0x24/0x60\r\n<6>[  523.818106] [<ffffff800819b38c>] path_openat+0x924/0xd9c\r\n<6>[  523.818535] [<ffffff800819b900>] do_filp_open+0x64/0x100\r\n<6>[  523.818783] [<ffffff800818caac>] do_sys_open+0x144/0x220\r\n<6>[  523.819213] [<ffffff800818cbc0>] SyS_openat+0x10/0x18\r\n<6>[  523.819461] [<ffffff8008084630>] el0_svc_naked+0x24/0x28\r\n<0>[  523.819898] Code: b9003353 97fbbd04 f9401341 aa1a03e0 (f9400821) \r\n<4>[  523.825277] ---[ end trace aab883580b072f6f ]---\r\n<0>[  523.830559] Kernel panic - not syncing: Fatal exception\r\n<3>[  525.230973] cpr3_panic_callback: PWR_CPRH_STATUS[0x179cbaa4] = 0x0000ac0d\r\n<3>[  525.231107] cpr3_panic_callback: APCLUS0_L2_SAW4_PMIC_STS[0x17912c18] = 0x000402b0\r\n<3>[  525.231182] cpr3_panic_callback: PERF_CPRH_STATUS[0x179c7aa4] = 0x004c9e00\r\n<3>[  525.231314] cpr3_panic_callback: APCLUS1_L2_SAW4_PMIC_STS[0x17812c18] = 0x00040278\r\n<3>[  525.231391] clk_osm_panic_callback: WDOG_DOMAIN_PSTATE_STATUS_0=0x00000000\r\n<3>[  525.231523] clk_osm_panic_callback: WDOG_PROGRAM_COUNTER_0=0x00000000\r\n<3>[  525.231658] clk_osm_panic_callback: APM_STATUS_0=0x00000000\r\n<3>[  525.231733] clk_osm_panic_callback: WDOG_DOMAIN_PSTATE_STATUS_1=0x00000000\r\n<3>[  525.231868] clk_osm_panic_callback: WDOG_PROGRAM_COUNTER_1=0x00000000\r\n<3>[  525.231942] clk_osm_panic_callback: APM_STATUS_1=0x00000000\r\n<3>[  525.232215] ipa ipa3_active_clients_panic_notifier:333 \r\n<3>[  525.232215] ---- Active Clients Table ----\r\n<3>[  525.232215] \r\n<3>[  525.232215] Total active clients count: 0\r\n<0>[  525.232349] Kernel Offset: disabled\r\n<0>[  525.232420] Memory Limit: none\r\n```\r\n\r\n**Symptoms**\r\n\r\n\r\n**How to reproduce**\r\nInstall the `fscryptctl` tool in your android tree:\r\n\r\n```bash\r\n$ croot\r\n$ cd external\r\n$ git clone https://github.com/google/fscryptctl\r\n```\r\nIt can be built using the following android makefile:\r\n\r\n```make\r\nLOCAL_PATH := $(call my-dir)\r\n\r\nRELEASE_VERSION := 0.1.0\r\nTAG_VERSION := $(shell git -C $(LOCAL_PATH) describe --tags 2>/dev/null)\r\nVERSION := $(if $(TAG_VERSION),$(TAG_VERSION),$(RELEASE_VERSION))\r\n\r\ninclude $(CLEAR_VARS)\r\n\r\nLOCAL_SRC_FILES := \\\r\n    fscryptctl.c \\\r\n    sha512.c \\\r\n\r\nLOCAL_CFLAGS := -DVERSION=\"\\\"$(VERSION)\\\"\"\r\nLOCAL_MODULE := fscryptctl\r\nLOCAL_MODULE_TAGS := optional\r\ninclude $(BUILD_EXECUTABLE)\r\n```\r\nBuild `fscryptctl` and push it onto your device.\r\nNext, create an ext4-encrypted directory by adapting the example given in the README.md file for `fscryptctl` :\r\n\r\n```\r\nmaple:/ # cd /data/local/tmp/                                                                                                                                                                \r\nmaple:/data/local/tmp # dd if=/dev/urandom of=key.data count=64 bs=1\r\nmaple:/data/local/tmp # fscryptctl insert_key --ext4 < key.data\r\ncd8c77009a9a3e6d\r\nmaple:/data/local/tmp # mkdir private\r\nmaple:/data/local/tmp # fscryptctl set_policy cd8c77009a9a3e6d /data/local/tmp/private\r\nmaple:/data/local/tmp # fscryptctl get_policy /data/local/tmp/private\r\nEncryption policy for /data/local/tmp/private:\r\n        Policy Version: 0\r\n        Key Descriptor: cd8c77009a9a3e6d\r\n        Contents: AES-256-XTS\r\n        Filenames: AES-256-CTS\r\n        Padding: 32\r\nmaple:/data/local/tmp # echo \"so long, and thanks for all the fish\" > private/good-bye.txt\r\n```\r\nWhen you attempt to create a file inside the encrypted directory, the system hangs for a few seconds and then reboots."}}
{"actor":{"display_login":"jerpelea"}}